Security Bug with Adminer

User can open via direct JS-Input the Adminer Plugin. So he can change his permission and get access to everything.