CVE-2026-109347

7.2 HIGHpublic exploit available

Published 2026-10-12 · Updated 2026-10-16

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-94

Public exploit & PoC references

https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59
https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59

All references

https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59
https://www.vulncheck.com/advisories/adminer-before-6.1.1-rce-via-utf-8-bom-sqlite-attach-bypass
https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

CRITICALCVE-2024-31026
HIGHCVE-2024-42002PoC
HIGHCVE-2026-0322
MEDIUMCVE-2026-100152
MEDIUMCVE-2026-100157
MEDIUMCVE-2026-100159
UNSCOREDCVE-2026-100174PoC
HIGHCVE-2026-10026

Related by shared AI tags and CWE weakness class. Browse the full archive.