PlatformPlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
high·Product Based Web Vulnerabilities·Updated Feb 22, 2026

Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsurl
CostFree
3.5k
Times Used
continuous scan runs
0
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2026-25892
7.5
CVSShigh
Exploitable remotely over the internet · no authentication required.

Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, openssl_verify() receives this array instead of string and throws TypeError, returning HTTP 500 to all users. Upgrade to Adminer 5.4.2.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
adminerby vrana
>= 4.6.2, < 5.4.2
Updated Sep 9, 2026View on NVD →
Similar Tools
critical
NVIDIA Triton Inference Server <= 26.02 - Authentication Bypass
→low
Wordpress Denial of Service Scanner
→critical
Metabase - Remote Code Execution (Apache Log4j)
→high
Apache Tomcat WebSocket Frame Payload Length Validation Denial of Service Scanner
→high
CVE-2020-16139 Scanner
→critical
JBossMQ HTTP Invocation Layer (HTTPServerILServlet) - Unauthenticated Java Deserialization
→

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS Scanner | S4E