CVE-2025-43960 Adminer PHP Object Injection issue leads to Denial of Service
Remote attackers can cause denial of service via memory exhaustion in Adminer when Monolog logging is enabled, requiring manual server recovery.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-43960?
CVE-2025-43960 is a high-severity unsafe deserialization vulnerability in n/a, published on 25 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., using s:1000000000), leading to a PHP Object Injection issue. Remote, unauthenticated attackers can trigger this by sending a malicious serialized object, which forces excessive memory usage, rendering Adminer’s interface unresponsive and causing a server-level DoS. While the server may recover after several minutes, multiple simultaneous requests can cause a complete crash requiring manual intervention.
Weakness: CWE-502
Which versions are affected by CVE-2025-43960?
2 open source packages ship an affected version, including vrana/adminer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vrana/adminer Packagist | All versions to 4.8.1 | None |
vrana/adminer Packagist | All versions to 4.8.1 | None |
Products include Adminer Adminer.
How do I fix CVE-2025-43960?
No fix has been published for CVE-2025-43960 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-43960 being exploited?
There is no known exploitation of CVE-2025-43960 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2021-21311 Adminer Server-Side Request Forgery
- CVE-2018-7667 vrana/adminer vulnerable to SSRF by connecting to privileged ports
- CVE-2026-25892 Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint
- CVE-2021-43008 Files or Directories Accessible to External Parties in Adminer
- CVE-2021-29625 XSS in doc_link
Sources
Also known as DEBIAN-CVE-2025-43960, GHSA-mqh4-2mm8-g7w9, UBUNTU-CVE-2025-43960.