Loading story…
CVE-2026-56705 affects vrana/adminer versions before 5.4.3 and permits unauthenticated remote code execution through the MSSQL connection workflow. Insufficient sanitization of the server field lets an attacker inject ODBC parameters into the PDO DSN using semicolons; the issue carries a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and is categorized as CWE-73.
An attacker can set the ODBC TraceFile and TraceOn options to place PHP content in a web-accessible directory, then request the generated trace file to execute code on the server. A Nuclei proof-of-concept template reportedly validated exploitation against a vulnerable local Adminer instance and did not trigger against version 5.4.3. Organizations exposing Adminer with MSSQL support should upgrade to 5.4.3 or later and investigate web roots for unexpected trace or PHP files.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A Nuclei template demonstrated exploitation through Adminer's MSSQL authentication flow by writing pwn56705.php to candidate web roots and requesting it to confirm execution. It produced critical findings against a vulnerable local instance, including root-context execution, while a local Adminer 5.4.3 instance produced no findings.
CVE-2026-56705 was received by disclosure@vulncheck.com for an unauthenticated remote code execution flaw affecting Vrana Adminer versions before 5.4.3. The flaw permits MSSQL PDO DSN parameter injection through the server field, enabling TraceFile and TraceOn abuse to write PHP code into a web-accessible location.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical blind SQL injection flaw tracked as **`CVE-2026-57517`** affects **Control Web Panel** versions **`<= 0.9.8.1224`** through the **`userRes`** POST parameter on the user endpoint. Public disclosure says the bug can be exploited remotely without authentication, although an attacker may need to know or guess a valid non-root username on the target instance. The issue carries a **CVSS v3.1 score of 9.8** and allows arbitrary SQL execution against the backend database with **MySQL root** privileges. The disclosed attack path shows the database access can be escalated into arbitrary file write using MySQL features such as **`INTO DUMPFILE`**, allowing a PHP webshell to be written into a web-accessible **Roundcube logs** directory and resulting in remote code execution as the **`cwpsvc`** account. The vulnerability was disclosed by **Egidio Romano**, and the vendor has fixed it in **Control Web Panel `0.9.8.1225`**; administrators are being urged to upgrade immediately and apply the vendor's security updates.
Jul 2, 2026
Two high-severity vulnerabilities in **Dolibarr ERP/CRM** allow authenticated administrators to achieve remote code execution through separate application paths. `CVE-2026-22666` affects versions before **23.0.2** and stems from the `dol_eval_standard()` function, which can be abused through computed extrafields and other evaluation paths because forbidden string checks are not properly enforced in whitelist mode and PHP dynamic callable syntax is not detected. The flaw enables arbitrary command execution via `eval()` and is classified as **CWE-95**. A second issue, `CVE-2026-23500`, affects versions before **23.0.0** and exposes an OS command injection bug in the ODT-to-PDF conversion workflow in `odf.php`. The `MAIN_ODT_AS_PDF` configuration constant is concatenated into a shell command passed to `exec()` without sanitization, allowing an authenticated administrator to inject shell separators and run arbitrary commands as the web server user when generating an ODT template. The vulnerabilities were addressed in **Dolibarr 23.0.0** and **23.0.2**, underscoring the need for organizations running Dolibarr to upgrade promptly.
Jun 29, 2026
Drupal released security updates for **CVE-2026-9082**, a highly critical SQL injection flaw in Drupal core that affects websites using **PostgreSQL** databases. The vulnerability stems from improper neutralization of special characters in user input within Drupal's database API, allowing an unauthenticated remote attacker to send crafted requests that can trigger SQL injection. Successful exploitation could lead to **information disclosure**, **privilege escalation**, and in some environments potentially **remote code execution**. Drupal and downstream defenders urged administrators to upgrade to fixed versions **10.4.10**, **10.5.10**, **10.6.9**, **11.1.10**, **11.2.12**, or **11.3.10**, while manual patches were also issued for unsupported **8.9** and **9.5** branches; the flaw's severity was raised to **CVSS 9.8** after initial scoring understated the risk.
Jul 24, 2026