CVE-2017-20066: adminer_login_project adminer_login Incorrect Authorization
Vulnerability summary
CVE-2017-20066 is a critical (CVSS 9.8) Incorrect Authorization vulnerability in adminer_login_project adminer_login. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.7% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 20-06-2022PublishedVulnerability first disclosed.
- 15-04-2025Last modifiedVulnerability information updated.
Description
A vulnerability has been found in Adminer Login 1.4.4 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improper access controls. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
CVSS metrics
4 scores · 3 sources · 2 versions- CVE.orgCNA5.3MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
0.00 pp
From 0.40% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (sumofpwn.nl)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Affected systems
Adminer_login_project1 product
- adminer_login1.4.4
Unspecified1 product
- adminer login1.4.4
Wordpress1 product
- adminer≤ 1.4.5
3 vendors · 3 products
References
4 links- sumofpwn.nl/advisory/2016/wordpress_adminer_plugin_allows_public__local__database_login.htmlX Refsource MISCExploitThird Party Advisory