CVE-2026-56705

COMPONENT VERSION RANGE

NewScan fingerprints Adminer from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-08-25. Adminer's 2026-08-25 batch - TEN CVEs in one day, the largest single-product cluster the daily triage has produced - and until today the packs could not read an Adminer version at all, so none of it was writable. The VERSION SOURCE is the new tech_signatures "Adminer" body row, MEASURED anonymously on vulhub/adminer:4.7.8 and on the current adminer:latest (6.0.1). ONE row for the 5.4.3 train rather than seven, on the iTop/Bouncy Castle precedent: 5.4.3 fixes every id here, so seven rows would be seven findings that all say `upgrade to 5.4.3`. Recorded `critical` under docs/severity-standard.md because the head id is UNAUTHENTICATED and ends in code execution on the box: CVE-2026-56705 (9.3) injects ODBC parameters through semicolons in the login form's `server` field, which Adminer splices into a PDO DSN before any credential is checked, so the precondition is only that the console is reachable - which is exactly what our interfaces.json Adminer row already reports. The six in `cves` are the rest of the same release and all need a login first: CVE-2026-56703 (8.6, SQLite VACUUM INTO reaches RCE despite the ATTACH block), CVE-2026-34968 (7.2, the SQLite database-list drop action deletes any file because it never checks the extension), CVE-2026-56702 (7.1, the AdminerFileUpload plugin accepts .php), CVE-2026-56706 (6.1, the (rand XOR secret):rand CSRF token ships both halves so one observed token recovers the server secret) and CVE-2026-56704 (5.3, a rogue MySQL server's version string lands inside a nonced script tag). CVE-2026-34967 (5.3, arbitrary file write via the sql-log plugin `ns` parameter) is listed here rather than in its own row because its range is 5.3.0-5.4.2, inside this band; it additionally needs that plugin enabled, so it is a `cves` claim and never the headline. DELIBERATELY NOT CLAIMED: CVE-2026-16434 (2.3, the backslash bypass of the X-Forwarded-Prefix guard, fixed only in 5.5.1) - a third row for a 2.3 open-redirect variant would be noise, and folding it into either band here would over-claim the band's severity.