CVE-2026-25892 PoC — Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25892.yaml

Associated Vulnerability

Title:Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint (CVE-2026-25892)
Description:Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, openssl_verify() receives this array instead of string and throws TypeError, returning HTTP 500 to all users. Upgrade to Adminer 5.4.2.

Description

Adminer <= 5.4.1 contains a denial of service caused by lack of origin validation in version check endpoint, letting attackers trigger server errors via crafted POST requests, exploit requires no special privileges.

File Snapshot


 id: CVE-2026-25892

info:
  name: Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS
  author: Dhi

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!