Adminer before version 6.0.2 is vulnerable to uncontrolled script injection when the CONNECTION_ID() database result is placed directly into JavaScript without escaping. This cross‑site scripting flaw permits an attacker who can influence the database output to execute arbitrary JavaScript code in the context of an authenticated Adminer session, effectively hijacking the browser session of the authenticated user. If the attacker can also control the database server or have FILE privileges that allow writing to the webroot, the XSS can be used to submit authenticated SQL queries that write PHP code via INTO DUMPFILE, resulting in remote code execution with the web server account.

Adminer versions prior to 6.0.2 from the vendor vrana are affected. The vulnerability applies to any deployment using those versions, regardless of operating system, as long as the application is running under a web server and a database connection is established.

The severity is moderate with a CVSS score of 5.3. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply malicious database output and, for the remote code execution path, the attacker must have control over the database server or have FILE privilege to write PHP files to the web root. Therefore the primary attack vector is a compromised database server or a user with elevated database permissions. The likelihood of exploitation depends on the presence of such privileges; in environments where database users are tightly scoped, the risk is reduced.