SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-56705

CRITICAL · CVSS 9.8 EPSS 0.50% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-25 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

Adminer versions prior to 5.4.3 are vulnerable due to insufficient sanitization of the server field, enabling unauthenticated attackers to inject ODBC parameters through semicolons. This flaw allows for the injection of TraceFile and TraceOn parameters, which can lead to remote code execution by writing PHP code to the web root when the trace file is accessed. Organizations using affected versions should prioritize immediate updates to mitigate this critical risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
remote code execution code execution
GitHub PoC Links
github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-56705
Severity
CRITICAL
CVSS
9.8
EPSS
0.50%

Original NVD Description

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when the trace file is accessed.