Is CVE-2026-56704 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-56704?

CVE-2026-56704 has a CVSS v3 severity of MEDIUM (6.1).

Back

CVE-2026-56704

Description

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing Content Security Policy protections.