Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

vrana/adminer

              main @ 0bd9ef7
            

Fixes

CVEs

HIGH

Peak severity

28.6%

Coverage

Highlights

CSRF: 15 prior fixes. Scrutinize any change in this area.

adminer/include/auth.inc.php: most-fixed (22 issues). Treat as high-risk during review.

49 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

CSRF: The highest-volume vulnerability class, with fixes spanning login, logout, KILL queries, SQL operators, settings, and plugin actions. Many fixes rely on Sec-Fetch-Site and token verification, and one fixed a bypass in dump requests.

Auth Bypass: Multiple bypasses in login and session handling, including password-less plugins accepting any password, missing session checks, and improper permanent login cookie handling.

Reflected XSS: A large number of output encoding gaps in database-provided values, table metadata, and JavaScript contexts. One fix hardened event delegation to prevent invoking dangerous built-in functions.