CVE-2026-15686

{
  "id": "CVE-2026-15686",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-20T17:17:21.180",
  "lastModified": "2026-10-26T10:10:00.140",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adminer. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the multi_query method. The issue results from an incorrect check of a function return value. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-28201."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ejecución remota de código por comprobación incorrecta del valor de retorno de una función en Adminer multi_query. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Adminer. Se requiere autenticación para explotar esta vulnerabilidad.\n\nLa falla específica existe dentro del método multi_query. El problema resulta de una comprobación incorrecta del valor de retorno de una función. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del servidor web. Fue ZDI-CAN-28201."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Adminer",
          "product": "Adminer",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "5.4.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-21T00:00:00+00:00",
          "id": "CVE-2026-15686",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-253"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/vrana/adminer/security/advisories/GHSA-3582-q6xq-5vf7#event-826206",
      "source": "[email protected]"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-478/",
      "source": "[email protected]"
    }
  ]
}