XSS in doc_link
Impact
Users of MySQL, MariaDB, PgSQL and SQLite are affected. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a pdo_ extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected.
Patches
Patched by 4043092, included in version 4.8.1.
Workarounds
Do both:
- Use browser supporting strict CSP.
- Enable the native PHP extensions (e.g.
mysqli) or disable displaying PHP errors (display_errors).
References
https://sourceforge.net/p/adminer/bugs-and-features/797/
For more information
If you have any questions or comments about this advisory:
- Comment at 4043092.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | vrana/adminer | >= 4.7.8, < 4.8.1 | 4.8.1 |
References
- https://github.com/vrana/adminer/security/advisories/GHSA-2v82-5746-vwqc
- https://nvd.nist.gov/vuln/detail/CVE-2021-29625
- https://github.com/vrana/adminer/commit/4043092ec2c0de2258d60a99d0c5958637d051a7
- https://packagist.org/packages/vrana/adminer
- https://sourceforge.net/p/adminer/bugs-and-features/797
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-79- Platform
- Composer
- Package
vrana/adminer- Disclosed
- 18.03.2022
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-2v82-5746-vwqc - CC BY 4.0
Vulnerability history: vrana/adminer
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 8
- First → latest
- 02.2021 02.2026
- Without a fix
- 1
- Exploited in attacks
- 1
Severity breakdown
- High 6
- Medium 2
Disclosures per year
- 2021: 3
- 2022: 2
- 2023: 0
- 2024: 1
- 2025: 1
- 2026: 1
-
XSS in doc_link this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.