CVE-2021-21311
Adminer Server-Side Request Forgery Vulnerability
Published Feb 11, 2021 · updated Jun 16, 2026 · adminer adminer
Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. ) are affected. This is fixed in version 4.7.9.
Timeline
Detection, updates, and resolution for this record.
Feb 11, 2021 · Catalog
Detected
Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. ) are affected. This is fixed in version 4.7.9.
Sep 29, 2025 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Oct 20, 2025 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. ) are affected. This is fixed in version 4.7.9.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Oct 20, 2025
Affected
- cpe adminer/adminerversion unspecified
- cpe debian/debian linux9.0
- vendor Adminer Adminerversion unspecified
Sources
- CISA KEVCVE-2021-21311
Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.
cisa.gov - CVE.orgCVE-2021-21311
Official CVE identifier
cve.org - FIRST EPSSCVE-2021-21311
30-day exploitation probability 98.5%
first.org - NIST NVDCVE-2021-21311
Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. ) are affected. This is fixed in version 4.7.
nvd.nist.gov