Security readout for executives and security teams
Plain-English summary
Adminer had a cross-site scripting flaw that could let an attacker run unwanted browser-side actions in a user’s Adminer session. The issue is most concerning where Adminer is exposed and used with affected versions. Modern strict CSP reduces practical impact, but the vendor patched it in 4.8.1.
Executive priority
Treat as a priority update for any exposed Adminer instance. The issue is patched and has high potential impact, but available sources do not indicate confirmed active exploitation.
Technical view
CVE-2021-29625 is a CWE-79 XSS issue in Adminer doc_link. Sources describe affected Adminer 4.6.1 through 4.8.0, with the bundle also listing >=4.7.8 and <4.8.1. CVSS 3.1 is 7.5, with network attack vector, high complexity, no privileges, and required user interaction.
Likely exposure
Exposure is likely limited to organizations running Adminer 4.x in the affected range, especially MySQL, MariaDB, PgSQL, or SQLite use through pdo_ extensions, or access from browsers without strict CSP support.
Exploitation context
The bundle does not show CISA KEV listing or cited evidence of active exploitation. Exploitation requires user interaction and is constrained by modern browser CSP, except in the pdo_ extension scenario described by the advisory.
Researcher notes
Do not assume all Adminer 4.x installs are equally exposed. Validate exact version, database backend, PHP extension path, browser CSP behavior, and display_errors state. Note the source bundle contains slightly different affected range statements.
Mitigation direction
- Upgrade Adminer to version 4.8.1 or later.
- Prefer native PHP database extensions, such as mysqli, over pdo_ where applicable.
- Use browsers that enforce strict CSP.
- Disable PHP display_errors if upgrade is temporarily delayed.
- Check vendor guidance before applying compensating controls.
Validation and detection
- Inventory all Adminer deployments and record exact versions.
- Confirm whether affected deployments use pdo_ database extensions.
- Verify Adminer is upgraded to 4.8.1 or later.
- Confirm PHP display_errors is disabled where compensating controls are needed.
- Review whether Adminer is internet-facing or restricted to trusted networks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-29625 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H1.65.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/vrana/adminer/security/advisories/GHSA-2v82-5746-vwqcCVE reference · x_refsource_CONFIRM
- https://github.com/vrana/adminer/commit/4043092ec2c0de2258d60a99d0c5958637d051a7CVE reference · x_refsource_MISC
- https://sourceforge.net/p/adminer/bugs-and-features/797/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.