Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
107 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS.
Recommended action: Upgrade to 5.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger Cross-site Scripting (XSS) by uploading a crafted .sql file through the drag-and-drop interface. By disabling the configuration directive $cfg['enabledragdropimport'], users will be unable to use the drag and drop upload which would protect against the vulnerability.
Recommended action: Upgrade to 5.2.1 or 4.9.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.0.2 via the tblstorageengine or tblcollation parameters to tblcreate.php.
Recommended action: Upgrade to 5.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.
Recommended action: Upgrade to 4.9.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.
Recommended action: Upgrade to 5.0.3 or 4.9.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.
Recommended action: Upgrade to 5.0.3 or 4.9.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its privileges).
Recommended action: Upgrade to 5.0.2 or 4.9.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tblgetfield.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.
Recommended action: Upgrade to 5.0.2 or 4.9.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.
Recommended action: Upgrade to 5.0.2 or 4.9.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.
Recommended action: Upgrade to 5.0.1 or 4.9.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.
Recommended action: Upgrade to 4.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim.
Recommended action: Upgrade to 4.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature.
Recommended action: Upgrade to 4.9.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in libraries/Error.class.php in phpMyAdmin 3.x before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to a PHP backtrace and error messages (aka debugging messages), a different vulnerability than CVE-2010-3056.
Recommended action: Upgrade to 3.3.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to phpinfo.php, which calls the phpinfo function.
Recommended action: Upgrade to 3.4.0-beta1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 uses predictable filenames for temporary files, which has unknown impact and attack vectors.
Recommended action: Upgrade to 2.11.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Open redirect vulnerability in the redirector feature in phpMyAdmin 3.4.x before 3.4.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Recommended action: Upgrade to 3.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via a Table Operations (1) TRUNCATE or (2) DROP link for a crafted table name, (3) the Add Trigger popup within a Triggers page that references crafted table names, (4) an invalid trigger-creation attempt for a crafted table name, (5) crafted data in a table, or (6) a crafted tooltip label name during GIS data visualization, a different issue than CVE-2012-4345.
Recommended action: Upgrade to 3.5.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.3.x before 3.3.10.1 and 3.4.x before 3.4.1 allow remote attackers to inject arbitrary web script or HTML via a crafted table name that triggers improper HTML rendering on a Tracking page, related to (1) libraries/tbllinks.inc.php and (2) tbltracking.php.
Recommended action: Upgrade to 3.4.1 or 3.3.10.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.8 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted database name, related to the Database Synchronize panel; (2) a crafted database name, related to the Database rename panel; (3) a crafted SQL query, related to the table overview panel; (4) a crafted SQL query, related to the view creation dialog; (5) a crafted column type, related to the table search dialog; or (6) a crafted column type, related to the create index dialog.
Recommended action: Upgrade to 3.4.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a procedure, or (3) a trigger.
Recommended action: Upgrade to 3.5.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
Recommended action: Upgrade to 3.5.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
Recommended action: Upgrade to 3.5.2.2 or 3.4.11.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request.
Recommended action: Upgrade to 4.0.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in (1) an anchor identifier to setup/index.php or (2) a chartTitle (aka chart title) value.
Recommended action: Upgrade to 3.5.8.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.