Adminer versions prior to 5.4.3 insert the database server version string directly into a script element that includes a valid Content Security Policy nonce. Because the string is not validated or escaped, a crafted MySQL version response can close the string literal, inject arbitrary JavaScript, and be executed by the victim’s browser. This flaw represents a classic stored cross‑site scripting vulnerability (CWE‑79) that allows an attacker to run client‑side code and potentially hijack user sessions or steal sensitive data. The problem is confined to the code path that renders the MySQL version information.

The vulnerability affects the Adminer web‑based database management tool distributed by Vrana. All releases before version 5.4.3 are impacted. Administrators using these earlier versions should verify which database engines are connected and note that the flaw is limited to the feature that outputs the MySQL version string.

The CVSS score of 5.3 indicates moderate severity, and no EPSS score is available, so the exact likelihood of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must control or impersonate a MySQL server that the vulnerable Adminer instance connects to. Because the exploited payload is delivered from the database server during normal operation, the attack can be launched remotely from a high‑level network perspective. This inferred attack vector means that any system exposing Adminer to an untrusted or shared database server may be susceptible, even without direct user interaction from the attacker.