CVE-2021-21311

7.2

HIGH CVSS 3.1

Adminer Server-Side Request Forgery Vulnerability - [Actively Exploited]

Description

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.

INFO

Published Date :

Feb. 11, 2021, 9:15 p.m.

Last Modified :

Oct. 24, 2025, 2:48 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Oct 20, 2025

Alert Date: Sep 29, 2025 | 32 days ago

Description :

Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

https://github.com/vrana/adminer/security/advisories/GHSA-x5r2-hj5c-8jx6 ; https://nvd.nist.gov/vuln/detail/CVE-2021-21311

Affected Products

The following products are affected by CVE-2021-21311 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Debian	debian_linux
1	Adminer	adminer

: Total Affected Vendor : 2 | Products : 2

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Version	Severity	Source
CVSS 2.0	MEDIUM	[email protected]
CVSS 3.1	HIGH	[email protected]
CVSS 3.1	HIGH	[email protected]

Solution

A server-side request forgery vulnerability exists in Adminer.

Upgrade Adminer to version 4.7.9 or later.
Update the Adminer package.

Public PoC/Exploit Available at Github

CVE-2021-21311 has a 24 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2021-21311.

URL	Resource
https://github.com/vrana/adminer/commit/ccd2374b0b12bd547417bf0dacdf153826c83351	Patch
https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf	Exploit Third Party Advisory
https://github.com/vrana/adminer/security/advisories/GHSA-x5r2-hj5c-8jx6	Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00002.html	Mailing List Third Party Advisory
https://packagist.org/packages/vrana/adminer	Product Third Party Advisory
https://github.com/vrana/adminer/commit/ccd2374b0b12bd547417bf0dacdf153826c83351	Patch
https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf	Exploit Third Party Advisory
https://github.com/vrana/adminer/security/advisories/GHSA-x5r2-hj5c-8jx6	Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00002.html	Mailing List Third Party Advisory
https://packagist.org/packages/vrana/adminer	Product Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21311	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2021-21311 is associated with the following CWEs:

CWE-918: Server-Side Request Forgery (SSRF)

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2021-21311 weaknesses.

CAPEC-664: Server Side Request Forgery Server Side Request Forgery

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

intercladire/Awesome-POC

None

Updated: 3 weeks, 4 days ago

1 stars 0 fork 0 watcher

Born at : Oct. 5, 2025, 7:46 p.m. This repo has been linked 250 different CVEs too.

g1san/Agents-for-Vulnerable-Dockers-and-related-Benchmarks

This thesis project focuses on the creation of an autonomous agent that is capable of understanding CVE description and create from its interpretation a vulnerable Docker container, which can then be used to gather attack patterns data. The Docker creation process is benchmarked in order to understand how well the agent is performing its tasks.

Dockerfile HTML Python Shell Groovy PHP Java SaltStack JavaScript CSS

Updated: 1 week ago

0 stars 0 fork 0 watcher

Born at : April 1, 2025, 1:35 p.m. This repo has been linked 115 different CVEs too.

ranhn/Goby-Poc

此次更新共包含1314个自定义gobypoc，是否含有后门和重复自行判断，如果无红队版，可直接poc管理处导入自定义poc即可，共计1314个。

Updated: 4 months, 1 week ago

5 stars 0 fork 0 watcher

Born at : Jan. 8, 2025, 6:20 a.m. This repo has been linked 40 different CVEs too.

XiaomingX/awesome-poc-for-red-team

A curated collection of Proof of Concept (PoC) tools, scripts, and techniques designed for red team operations, penetration testing, and cybersecurity research. This repository focuses on providing practical resources for exploring vulnerabilities

attack cybersecurity exp hw penetration-testing poc red-team security-tools vulnerability-poc

Updated: 9 months, 1 week ago

5 stars 3 fork 3 watcher

Born at : Nov. 17, 2024, 11:53 a.m. This repo has been linked 414 different CVEs too.

J1ezds/Vulnerability-Wiki-page

这是一个每天同步Vulnerability-Wiki中docs-base中内容的项目

HTML

Updated: 1 month ago

5 stars 1 fork 1 watcher

Born at : Sept. 20, 2024, 3:27 a.m. This repo has been linked 255 different CVEs too.

tung6192/llm-security-hackathon

None

Dockerfile Python CSS HTML Shell Java Groovy Jupyter Notebook

Updated: 1 year, 4 months ago

0 stars 0 fork 0 watcher

Born at : June 10, 2024, 2:29 p.m. This repo has been linked 3 different CVEs too.

NaInSec/CVE-PoC-in-GitHub

All CVE - PoC in GitHub

poc proofofconcept tester allcve cvegithub cvenew cvepoc cveupdate

Updated: 4 months, 4 weeks ago

12 stars 3 fork 3 watcher

Born at : March 22, 2024, 3:58 p.m. This repo has been linked 931 different CVEs too.

zecool/cve

None

Updated: 4 months ago

2 stars 0 fork 0 watcher

Born at : March 11, 2024, 1:21 p.m. This repo has been linked 935 different CVEs too.

d4n-sec/d4n-sec.github.io

None

CSS HTML JavaScript

Updated: 1 year, 8 months ago

0 stars 0 fork 0 watcher

Born at : Feb. 2, 2024, 2:11 p.m. This repo has been linked 494 different CVEs too.

bakery312/Vulhub-Reproduce

None

Updated: 5 months, 1 week ago

5 stars 1 fork 1 watcher

Born at : Jan. 26, 2024, 10:07 a.m. This repo has been linked 161 different CVEs too.

NyxAzrael/Goby_POC

在公网收集的gobypoc+部分自己加的poc

Updated: 3 months, 1 week ago

111 stars 8 fork 8 watcher

Born at : July 28, 2023, 4:28 p.m. This repo has been linked 296 different CVEs too.

0day404/vulnerability-poc

A Common Vulnerability PoC Knowledge Base一个普遍漏洞POC知识库

vulnerability

Updated: 5 months, 2 weeks ago

21 stars 6 fork 6 watcher

Born at : June 24, 2023, 3:12 p.m. This repo has been linked 232 different CVEs too.

omoknooni/CVE-2021-21311

None

HCL Python

Updated: 11 months, 1 week ago

2 stars 0 fork 0 watcher

Born at : June 12, 2023, 1:32 p.m. This repo has been linked 1 different CVEs too.

whoforget/CVE-POC

None

Updated: 2 years, 7 months ago

0 stars 2 fork 2 watcher

Born at : April 8, 2023, 6:19 a.m. This repo has been linked 928 different CVEs too.

k0mi-tg/CVE-POC

None

Updated: 1 year, 8 months ago

20 stars 3 fork 3 watcher

Born at : Feb. 14, 2023, 6:10 p.m. This repo has been linked 921 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2021-21311 vulnerability anywhere in the article.

The Cyber Express

The Power of Two: Why MFA Matters More Than Ever

In a world where passwords are stolen, phished, or guessed every second, multifactor authentication (MFA) has quietly become one of the most effective shields against cyberattacks. Whether you call it ...

Published Date: Oct 09, 2025 (3 weeks ago)

The Cyber Express

Japan’s Beer Taps Fear Running Dry as Cyberattack on Asahi Disrupts Production

Japan’s largest brewery, Asahi Group Holdings, is racing against time as it struggles to recover from a cyberattack that has severely disrupted its operations. The Asahi cyberattack, which was first r ...

Published Date: Oct 03, 2025 (3 weeks, 6 days ago)

The Cyber Express

Your Easiest Fix: The 3 Golden Rules for a Password that AI Can’t Crack

October is here, and Cybersecurity Awareness Month 2025 is about to come into being. Department of Homeland Security (DHS) and CISA have initiated this year’s campaign with the theme of ‘Building our ...

Published Date: Oct 03, 2025 (3 weeks, 6 days ago)

The Cyber Express

Hackers Claim Breach of Red Hat Customer Data

Hackers claim to have breached a Red Hat GitHub instance and stolen sensitive customer data. The claims were made in Telegram posts by a group calling itself “Crimson Collective,” which said it exfilt ...

Published Date: Oct 02, 2025 (4 weeks ago)

The Cyber Express

New VMware Vulnerability CVE-2025-41244 Actively Exploited Since October 2024

A newly listed VMware zero-day vulnerability has been actively exploited by Chinese state-sponsored threat actors for almost a year, according to security researchers. The vulnerability, CVE-2025-4124 ...