Log in Start free

Vulnerability · Published Aug 25, 2025 · Assigned by mitre

CVE-2025-43960

High 8.6

In plain English

A high-severity unsafe deserialization in the adminer package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.7%top 45.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., using s:1000000000), leading to a PHP Object Injection issue. Remote, unauthenticated attackers can trigger this by sending a malicious serialized object, which forces excessive memory usage, rendering Adminer’s interface unresponsive and causing a server-level DoS. While the server may recover after several minutes, multiple simultaneous requests can cause a complete crash requiring manual intervention.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12adminerno fix listedDEBIAN-CVE-2025-43960
Debian:13adminerno fix listedDEBIAN-CVE-2025-43960
Debian:14adminerno fix listedDEBIAN-CVE-2025-43960
Packagistvrana/adminerno fix listedGHSA-mqh4-2mm8-g7w9
Ubuntu:22.04:LTSadminerno fix listedUBUNTU-CVE-2025-43960
Ubuntu:24.04:LTSadminerno fix listedUBUNTU-CVE-2025-43960
Ubuntu:25.10adminerno fix listedUBUNTU-CVE-2025-43960
Ubuntu:26.04:LTSadminerno fix listedUBUNTU-CVE-2025-43960
Ubuntu:26.10adminerno fix listedUBUNTU-CVE-2025-43960

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

References