Every CVE Search/ Get API key

CVE-2021-21311

SSRF in adminer

7.2 HighIn KEVPublic exploitFix available

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. adminer.php) are affected. This is fixed in version 4.7.9.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

98.5%Up 97.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.2

SSRF in adminer

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. adminer.php) are affected. This is fixed in version 4.7.9.

Record
CVE-2021-21311
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-918
Updated
2026-11-02
EUVDEUVD-2021-0576 7.2

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. adminer.php) are affected. This is fixed in version 4.7.9.

Record
EUVD-2021-0576
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-x5r2-hj5c-8jx6 7.2

SSRF in adminer

Impact

Users of Adminer versions bundling all drivers (e.g. adminer.php) are affected.

Patches

Patched by ccd2374b, included in version 4.7.9.

Workarounds

  • Use a single driver version (e.g. adminer-mysql.php).
  • Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or by OTP plugin.

References

https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf

For more information

If you have any questions or comments about this advisory:

  • Comment at ccd2374b.
Record
GHSA-x5r2-hj5c-8jx6
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:H
Weakness
CWE-918
Updated
2026-11-02
CISA KEV No score

Adminer Server-Side Request Forgery Vulnerability

Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.

Record
CVE-2021-21311
Weakness
CWE-918
Updated
2026-11-02
NVD 7.2

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. adminer.php) are affected. This is fixed in version 4.7.9.

Record
CVE-2021-21311
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS 2.0
6.4 MediumAV:N/AC:L/Au:N/C:P/I:P/A:N
Weakness
CWE-918
Updated
2026-11-02
OSV 7.2

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. adminer.php) are affected. This is fixed in version 4.7.9.

Record
CVE-2021-21311
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2021-21311 7.2

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. adminer.php) are affected. This is fixed in version 4.7.9.

Record
DEBIAN-CVE-2021-21311
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVGHSA-x5r2-hj5c-8jx6 7.2

SSRF in adminer

Impact

Users of Adminer versions bundling all drivers (e.g. adminer.php) are affected.

Patches

Patched by ccd2374b, included in version 4.7.9.

Workarounds

  • Use a single driver version (e.g. adminer-mysql.php).
  • Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or by OTP plugin.

References

https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf

For more information

If you have any questions or comments about this advisory:

  • Comment at ccd2374b.
Record
GHSA-x5r2-hj5c-8jx6
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:H
Weakness
CWE-918
Updated
2026-11-02
OSVUBUNTU-CVE-2021-21311 7.2

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. adminer.php) are affected. This is fixed in version 4.7.9.

Record
UBUNTU-CVE-2021-21311
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVUSN-5271-1 No score

adminer vulnerabilities

It was discovered that Adminer did not escape data in the history parameter of the default URI. A remote attacker could possibly use this issue to perform cross-site scripting (XSS) attacks. This issue only affected Ubuntu 20.04 ESM. (CVE-2020-35572)

Adam Crosser and Brian Sizemore discovered that Adminer incorrectly handled redirection requests to internal servers. An unauthenticated remote attacker could possibly use this to perform a server-side request forgery attack and expose sensitive information. (CVE-2021-21311)

It was discovered that Adminer was incorrectly escaping data in the doc_link function. A remote attacker could possibly use this issue to perform cross-site scripting (XSS) attacks. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-29625)

Record
USN-5271-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
vrana/adminer
Packagist
 before 4.7.9
4.7.9
adminer
Debian:12
 before 4.7.9-1
4.7.9-1
adminer
Debian:13
 before 4.7.9-1
4.7.9-1
adminer
Debian:14
 before 4.7.9-1
4.7.9-1
adminer
Debian:9
 before 4.2.5-3+deb9u2, plus listed versions
4.2.5-34.2.5-3+deb9u1
4.2.5-3+deb9u2
vrana/adminer
Packagist
 before 4.7.9, plus listed versions
v4.2.0v4.2.1v4.2.2v4.2.3v4.2.4
Show 18 moreShow less
v4.2.5v4.3.0v4.3.1v4.4.0v4.5.0v4.6.0v4.6.1v4.6.2v4.6.3v4.7.0v4.7.1v4.7.2v4.7.3v4.7.4v4.7.5v4.7.6v4.7.7v4.7.8
4.7.9
adminer
Ubuntu:Pro:16.04:LTS
 before 4.2.1-1ubuntu1+esm1, plus listed versions
4.2.1-14.2.1-1ubuntu1
4.2.1-1ubuntu1+esm1
adminer
Ubuntu:Pro:18.04:LTS
 before 4.6.2-1ubuntu0.1~esm1, plus listed versions
4.3.1-24.5.0-14.6.1-14.6.2-1
4.6.2-1ubuntu0.1~esm1
adminer
Ubuntu:Pro:20.04:LTS
 before 4.7.6-1ubuntu0.1~esm1, plus listed versions
4.7.2-14.7.4-14.7.5-14.7.6-1
4.7.6-1ubuntu0.1~esm1
adminer
Ubuntu:Pro:16.04:LTS
From an advisory covering 3 CVEs
 before 4.2.1-1ubuntu1+esm1, plus listed versions
4.2.1-14.2.1-1ubuntu1
4.2.1-1ubuntu1+esm1
adminer
Ubuntu:Pro:18.04:LTS
From an advisory covering 3 CVEs
 before 4.6.2-1ubuntu0.1~esm1, plus listed versions
4.3.1-24.5.0-14.6.1-14.6.2-1
4.6.2-1ubuntu0.1~esm1
adminer
Ubuntu:Pro:20.04:LTS
From an advisory covering 3 CVEs
 before 4.7.6-1ubuntu0.1~esm1, plus listed versions
4.7.2-14.7.4-14.7.5-14.7.6-1
4.7.6-1ubuntu0.1~esm1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubllhala/CVE-2021-213112022-02-14
PoC in GitHubomoknooni/CVE-2021-213112023-06-12
PoC in GitHubSudo-WP/sudowp-adminer2026-01-24
NucleiAdminer <4.7.9 - Server-Side Request Forgery

History

History
RecordedChangedSources
affected
exploitation, exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-21311 is a high vulnerability (CVSS 7.2) in Adminer, published February 11, 2021. CISA lists it as known to be exploited, since September 29, 2025. EUVD reports exploitation since September 29, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 98.5%, the 99th percentile. Fixed in vrana/adminer 4.7.9.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open