Nixpkgs security tracker

Permalink CVE-2026-25892

7.5 HIGH

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): NONE
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): NONE
Integrity impact (I): NONE
Availability impact (A): HIGH

created 2 months, 1 week ago Activity log

Created suggestion 2 months, 1 week ago

Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint

Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, openssl_verify() receives this array instead of string and throws TypeError, returning HTTP 500 to all users. Upgrade to Adminer 5.4.2.

References

https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh x_refsource_CONFIRM
https://github.com/vrana/adminer/commit/21d3a3150388677b18647d68aec93b7850e457d3 x_refsource_MISC
https://github.com/vrana/adminer/releases/tag/v5.4.2 x_refsource_MISC

Affected products

adminer

==>= 4.6.2, < 5.4.2

Matching in nixpkgs

pkgs.adminer

Database management in a single PHP file

nixos-unstable 5.3.0
- nixpkgs-unstable 5.4.1
- nixos-unstable-small 5.4.1
nixos-25.11 5.4.1
- nixpkgs-25.11-darwin 5.4.1

pkgs.adminerevo

Database management in a single PHP file

nixos-unstable 4.8.4
- nixpkgs-unstable 4.8.4
- nixos-unstable-small 4.8.4
nixos-25.11 4.8.4
- nixpkgs-25.11-darwin 4.8.4

Package maintainers

@haskelious Stephane Schitter <stephane@nix.frozenid.net>
@jtojnar Jan Tojnar <jtojnar@gmail.com>
@shyim Soner Sayakci <s.sayakci@gmail.com>

Permalink CVE-2025-39476

7.5 HIGH

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): HIGH
Privileges required (PR): NONE
User interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): HIGH
Availability impact (A): HIGH

created 10 months, 1 week ago Activity log

Created suggestion 10 months, 1 week ago

WordPress Revo theme <= 4.0.26 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Revo allows PHP Local File Inclusion. This issue affects Revo: from n/a through 4.0.26.