Adminer up to and including 4.7.8 allows XSS via the history parameter to the default URI.
adminer adminer