Is CVE-2026-100695 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100695 being exploited in the wild.

How severe is CVE-2026-100695?

Medium severity, with a CVSS score of 6.1, published 26 September 2026.

Is there a fix for CVE-2026-100695?

A patch was published on 2026-09-26: version 6.0.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100695 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100695?

Check whether you run Vrana Adminer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100695: Adminer cross-site scripting in CONNECTION_ID interpolation

CVE-2026-100695 · Severity: medium · CVSS 6.1 · Published 2026-09-26

Adminer, a web-based database management tool, fails to properly escape database responses when building JavaScript code, allowing a malicious database server to execute arbitrary JavaScript in an authenticated user's session. In environments where the database server has file write permissions to the web application directory, this XSS can be escalated to remote code execution by writing PHP files that execute as the web server account.

Technologies: Vrana Adminer. Vendors: Vrana.

Quick answers

Is CVE-2026-100695 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100695 being exploited in the wild.
How severe is CVE-2026-100695?: Medium severity, with a CVSS score of 6.1, published 26 September 2026.
Which products and versions are affected?: Vrana Adminer before 6.0.2.
Is there a fix for CVE-2026-100695?: A patch was published on 2026-09-26: version 6.0.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100695 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100695?: Check whether you run Vrana Adminer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the slow-query timeout handler, which inserts the unescaped result of CONNECTION_ID() directly into a JavaScript block that already carries a CSP nonce. A malicious MySQL-compatible database server can return JavaScript code instead of a numeric ID, executing arbitrary code in the authenticated origin. RCE requires additional preconditions: co-located database with FILE privileges, secure_file_priv permitting the webroot, and PHP execution enabled; the attacker can then write an auto-loaded adminer-plugins.php file via INTO DUMPFILE.

Affected products

Vrana Adminer before 6.0.2

Timeline

2026-09-26: disclosed
2026-09-26: patched: version 6.0.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.