CVE-2021-43008

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/vrana/adminer/releases/tag/v4.6.3Release Notes, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00012.htmlMailing List, Third Party Advisory
https://podalirius.net/en/cves/2021-43008/Exploit, Third Party Advisory
https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerabilityExploit, Third Party Advisory
https://www.adminer.org/Product
https://github.com/vrana/adminer/releases/tag/v4.6.3Release Notes, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00012.htmlMailing List, Third Party Advisory
https://podalirius.net/en/cves/2021-43008/Exploit, Third Party Advisory
https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerabilityExploit, Third Party Advisory
https://www.adminer.org/Product

Timeline

Published: Apr 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-430096.1A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the request URL.CVE-2021-43019.8A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical. Affected by this issue is some unknown functionality.CVE-2021-430107.5In Safedog Apache v4.0.30255, attackers can bypass this product for SQL injection. Attackers can bypass access to sensitive data.CVE-2021-430117.8Adobe Prelude version 10.1 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this CVE-2021-430127.8Adobe Prelude version 10.1 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this CVE-2021-430137.8Adobe Media Encoder version 15.4.1 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could levera CVE-2021-430157.8Adobe InCopy version 16.4 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious GIF file, p CVE-2021-430165.5Adobe InCopy version 16.4 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An un CVE-2021-430174.2Adobe Creative Cloud version 5.5 (and earlier) are affected by an Application denial of service vulnerability in the Creative Cloud Desktop CVE-2021-430187.8Adobe Photoshop versions 23.0.2 and 22.5.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary CVE-2021-430197.8Adobe Creative Cloud version 5.5 (and earlier) are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.CVE-2021-43026.1A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the compo