CVE-2026-56704
MEDIUM
NVD
CVSS Score
6.1
Severity
MEDIUM
Published
Aug 25, 2026
Vendor
unknown
Description
Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing Content Security Policy protections.