In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.
Max CVSS
5.4
EPSS Score
0.05%
Published
2023-02-13
Updated
2023-02-23
An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.
Max CVSS
6.1
EPSS Score
1.04%
Published
2022-01-22
Updated
2023-11-26
An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.
Max CVSS
4.3
EPSS Score
0.05%
Published
2022-01-22
Updated
2023-11-26
PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.
Max CVSS
7.5
EPSS Score
0.14%
Published
2022-03-10
Updated
2023-11-26
phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.
Max CVSS
6.1
EPSS Score
0.84%
Published
2020-10-10
Updated
2021-01-28
phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states "I don't see anything specifically exploitable.
Max CVSS
6.1
EPSS Score
0.11%
Published
2020-03-31
Updated
2024-03-21
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.
Max CVSS
5.4
EPSS Score
0.11%
Published
2020-03-22
Updated
2022-11-16
A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.
Max CVSS
6.5
EPSS Score
91.97%
Published
2019-09-13
Updated
2023-02-02
An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim.
Max CVSS
6.5
EPSS Score
1.70%
Published
2019-06-05
Updated
2019-06-14
An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of "options(MYSQLI_OPT_LOCAL_INFILE" calls.
Max CVSS
5.9
EPSS Score
18.29%
Published
2019-01-26
Updated
2020-08-24
In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name.
Max CVSS
6.1
EPSS Score
19.76%
Published
2018-12-11
Updated
2019-04-22
An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.
Max CVSS
6.5
EPSS Score
45.37%
Published
2018-12-11
Updated
2019-04-23
An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature.
Max CVSS
6.1
EPSS Score
0.22%
Published
2018-08-24
Updated
2018-10-26
An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature.
Max CVSS
6.1
EPSS Score
0.15%
Published
2018-06-21
Updated
2018-08-10
Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Max CVSS
5.4
EPSS Score
0.21%
Published
2018-02-21
Updated
2018-03-06
phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table name
Max CVSS
7.5
EPSS Score
0.10%
Published
2017-07-17
Updated
2019-03-20
A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18.
Max CVSS
7.5
EPSS Score
0.09%
Published
2017-07-17
Updated
2017-07-26
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parameters
Max CVSS
6.1
EPSS Score
0.08%
Published
2017-07-17
Updated
2019-03-20
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality
Max CVSS
7.5
EPSS Score
0.10%
Published
2017-07-17
Updated
2019-03-19
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness
Max CVSS
6.1
EPSS Score
0.08%
Published
2017-07-17
Updated
2019-03-19
An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the MySQL database. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Max CVSS
7.5
EPSS Score
0.33%
Published
2016-12-11
Updated
2017-07-01
An issue was discovered in phpMyAdmin. With a very large request to table partitioning function, it is possible to invoke a Denial of Service (DoS) attack. All 4.6.x versions (prior to 4.6.5) are affected.
Max CVSS
7.5
EPSS Score
0.29%
Published
2016-12-11
Updated
2017-07-01
An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected.
Max CVSS
7.5
EPSS Score
0.15%
Published
2016-12-11
Updated
2017-07-01
An issue was discovered in phpMyAdmin. Due to the limitation in URL matching, it was possible to bypass the URL white-list protection. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Max CVSS
7.5
EPSS Score
0.24%
Published
2016-12-11
Updated
2017-07-01
An issue was discovered in phpMyAdmin. An unauthenticated user can execute a denial of service attack when phpMyAdmin is running with $cfg['AllowArbitraryServer']=true. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Max CVSS
5.9
EPSS Score
0.29%
Published
2016-12-11
Updated
2017-07-01
234 vulnerabilities found
1 2 3 4 5 6 7 8 9 10
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!