CVE-2026-34964

COMPONENT VERSION RANGE

NewScan fingerprints Adminer from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-08-25, the SECOND band of the same Adminer batch, and disjoint from the row above on purpose: an install on 5.4.3 or 5.4.4 has the whole 5.4.3 train fixed and only these two left, so overlapping bands would put two findings on one host telling it to upgrade to two different versions. CVE-2026-34964 (6.9): the login form's `server` validator inspects only LEADING integers when deciding whether a port is privileged, so a crafted value reaches an arbitrary host:port through the PDO DSN - SSRF from an unauthenticated form. CVE-2026-34959 (5.3): X-Forwarded-Prefix is prepended to REQUEST_URI with no trusted-proxy check and no validation, giving an open redirect. `medium` and not high because neither ends in execution and the SSRF is blind at this layer. The band stops at 5.5.0 rather than 5.5.1 so exactly-5.5.0 installs are not told about these two, which 5.5.0 fixed.