CVE-2026-56704CWE-79cross-site-scripting

CVE-2026-56704

Medium · published August 25, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
25.9
In the wild
Unconfirmed
What it is

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing Content Security Policy protections.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00337 · 25.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-25T06:16Z
References (2)
https://github.com/vrana/adminer/security/advisories/GHSA-h6jr-7pr6-grgj · [email protected]https://www.vulncheck.com/advisories/adminer-before-cross-site-scripting-via-mysql-version-string · [email protected]
EPSS history
Timeline
  • 26 AUG 08:15Z
    EPSS moved — → 0%
    epss
  • 25 AUG 01:30Z
    Adminer before 5.4.3 Cross-Site Scripting via MySQL Version String
    cvelistv5