{"id":"CVE-2026-25892","published":"2026-02-09T21:26:45Z","modified":"2026-02-10T15:57:46Z","title":"Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint","vendor":"vrana","product":"adminer","tier":"tail","description":{"text":"Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, openssl_verify() receives this array instead of string and throws TypeError, returning HTTP 500 to all users. Upgrade to Adminer 5.4.2.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01718,"percentile":0.77361,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/vrana/adminer/commit/21d3a3150388677b18647d68aec93b7850e457d3","tags":["x_refsource_MISC"]},{"url":"https://github.com/vrana/adminer/releases/tag/v5.4.2","tags":["x_refsource_MISC"]}],"priority":{"score":25.7,"factors":[{"name":"EPSS percentile","points":15.47},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":5.25}]},"exploitSources":{"nuclei":[{"id":"CVE-2026-25892","name":"Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS","severity":"high","path":"http/cves/2026/CVE-2026-25892.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25892.yaml"}],"provenance":"source"},"vendorSlug":"vrana","affectedVersions":[{"vendor":"vrana","product":"adminer","versions":[">= 4.6.2, < 5.4.2"]}],"affected":[{"ecosystem":"Packagist","package":"vrana/adminer","vulnerableRanges":[">=4.6.2, <5.4.2"],"patched":["5.4.2"],"from":["GHSA-q4f2-39gr-45jh"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-6870","exploited":false,"provenance":"source"}}