ZeroDay Findings
Sign inSign up

Findings

CVE-2021-21311

Adminer Server-Side Request Forgery Vulnerability

Published Feb 11, 2021 · updated Jun 16, 2026 · adminer adminer

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. ) are affected. This is fixed in version 4.7.9.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 11, 2021 · Catalog

    Detected

    Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. ) are affected. This is fixed in version 4.7.9.

  2. Sep 29, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Oct 20, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. ) are affected. This is fixed in version 4.7.9.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Oct 20, 2025

Affected

  • cpe adminer/adminerversion unspecified
  • cpe debian/debian linux9.0
  • vendor Adminer Adminerversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2021-21311

    Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2021-21311

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2021-21311

    30-day exploitation probability 98.5%

    first.org
  • NIST NVDVulnerability recordCVE-2021-21311

    Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. ) are affected. This is fixed in version 4.7.

    nvd.nist.gov

References