CVE-2020-35572

vrana/adminer via XSS in the history parameter in SQL command

6.1 MediumFix available

Adminer through 4.7.8 allows XSS via the history parameter to the default URI.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

2.00%Up 1.4 points since Apr 14, 2021

What each source reports

NVD Score used 6.1

Adminer through 4.7.8 allows XSS via the history parameter to the default URI.

Record: CVE-2020-35572
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Adminer through 4.7.8 allows XSS via the history parameter to the default URI.

Record: CVE-2020-35572
Updated: 2026-11-02

EUVDEUVD-2021-0541 No score

Adminer through 4.7.8 allows XSS via the history parameter to the default URI.

Record: EUVD-2021-0541
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9pgx-gcph-mpqr 6.1

vrana/adminer via XSS in the history parameter in SQL command

Impact

Users of Adminer versions supporting SQL command (most versions, e.g. MySQL) using browsers not encoding URL parameters before sending to server (likely Edge, not Chrome, not Firefox) are affected.

Patches

Patched by 5c395afc, included in version 4.7.9.

Workarounds

Use browser which encodes URL parameters (e.g. Chrome or Firefox).

References

https://sourceforge.net/p/adminer/bugs-and-features/775/

For more information

If you have any questions or comments about this advisory:

Comment at https://sourceforge.net/p/adminer/bugs-and-features/775/

Record: GHSA-9pgx-gcph-mpqr
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.1

Adminer through 4.7.8 allows XSS via the history parameter to the default URI.

Record: CVE-2020-35572
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2020-35572 6.1

Adminer through 4.7.8 allows XSS via the history parameter to the default URI.

Record: DEBIAN-CVE-2020-35572
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-9pgx-gcph-mpqr 6.1

vrana/adminer via XSS in the history parameter in SQL command

Impact

Users of Adminer versions supporting SQL command (most versions, e.g. MySQL) using browsers not encoding URL parameters before sending to server (likely Edge, not Chrome, not Firefox) are affected.

Patches

Patched by 5c395afc, included in version 4.7.9.

Workarounds

Use browser which encodes URL parameters (e.g. Chrome or Firefox).

References

https://sourceforge.net/p/adminer/bugs-and-features/775/

For more information

If you have any questions or comments about this advisory:

Comment at https://sourceforge.net/p/adminer/bugs-and-features/775/

Record: GHSA-9pgx-gcph-mpqr
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-35572 6.1

Adminer through 4.7.8 allows XSS via the history parameter to the default URI.

Record: UBUNTU-CVE-2020-35572
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVUSN-5271-1 No score

adminer vulnerabilities

It was discovered that Adminer did not escape data in the history parameter of the default URI. A remote attacker could possibly use this issue to perform cross-site scripting (XSS) attacks. This issue only affected Ubuntu 20.04 ESM. (CVE-2020-35572)

Adam Crosser and Brian Sizemore discovered that Adminer incorrectly handled redirection requests to internal servers. An unauthenticated remote attacker could possibly use this to perform a server-side request forgery attack and expose sensitive information. (CVE-2021-21311)

It was discovered that Adminer was incorrectly escaping data in the doc_link function. A remote attacker could possibly use this issue to perform cross-site scripting (XSS) attacks. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-29625)

Record: USN-5271-1
Updated: 2026-11-02

Affected products

adminer

Affected packages

Affected packages
Package	Affected	Fixed
`vrana/adminer` Packagist	before 4.7.9	4.7.9
`adminer` Debian:12	before 4.7.9-1	4.7.9-1
`adminer` Debian:13	before 4.7.9-1	4.7.9-1
`adminer` Debian:14	before 4.7.9-1	4.7.9-1
`vrana/adminer` Packagist	before 4.7.9, plus listed versions v4.2.0v4.2.1v4.2.2v4.2.3v4.2.4 Show 18 moreShow less v4.2.5v4.3.0v4.3.1v4.4.0v4.5.0v4.6.0v4.6.1v4.6.2v4.6.3v4.7.0v4.7.1v4.7.2v4.7.3v4.7.4v4.7.5v4.7.6v4.7.7v4.7.8	4.7.9
`adminer` Ubuntu:Pro:20.04:LTS	before 4.7.6-1ubuntu0.1~esm1, plus listed versions 4.7.2-14.7.4-14.7.5-14.7.6-1	4.7.6-1ubuntu0.1~esm1
`adminer` Ubuntu:Pro:16.04:LTS From an advisory covering 3 CVEs	before 4.2.1-1ubuntu1+esm1, plus listed versions 4.2.1-14.2.1-1ubuntu1	4.2.1-1ubuntu1+esm1
`adminer` Ubuntu:Pro:18.04:LTS From an advisory covering 3 CVEs	before 4.6.2-1ubuntu0.1~esm1, plus listed versions 4.3.1-24.5.0-14.6.1-14.6.2-1	4.6.2-1ubuntu0.1~esm1
`adminer` Ubuntu:Pro:20.04:LTS From an advisory covering 3 CVEs	before 4.7.6-1ubuntu0.1~esm1, plus listed versions 4.7.2-14.7.4-14.7.5-14.7.6-1	4.7.6-1ubuntu0.1~esm1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-35572 is a medium vulnerability (CVSS 6.1) in Adminer, published February 9, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.00%, the 80th percentile. Fixed in vrana/adminer 4.7.9.

References

Show 8 moreShow less