CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Phpmyadmin » Phpmyadmin » * * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*
CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2022-23808 79 XSS 2022-01-22 2022-01-31
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.
2 CVE-2022-23807 287 Bypass 2022-01-22 2022-01-27
4.0
 None Remote Low ??? None Partial None
An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.
3 CVE-2022-0813 200 +Info 2022-03-10 2022-03-12
5.0
 None Remote Low Not required Partial None None
PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.
4 CVE-2020-26935 89 Sql 2020-10-10 2021-03-30
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.
5 CVE-2020-26934 79 XSS 2020-10-10 2021-01-28
4.3
 None Remote Medium Not required None Partial None
phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.
6 CVE-2020-22278 1236 2020-11-04 2020-11-13
6.8
 None Remote Medium Not required Partial Partial Partial
** DISPUTED ** phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because "the CSV file is accurately generated based on the database contents."
7 CVE-2020-10804 89 Sql 2020-03-22 2020-11-02
6.0
 None Remote Medium ??? Partial Partial Partial
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its privileges).
8 CVE-2020-10803 79 Sql XSS 2020-03-22 2020-11-02
3.5
 None Remote Medium ??? None Partial None
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.
9 CVE-2020-10802 89 Sql 2020-03-22 2020-11-02
6.0
 None Remote Medium ??? Partial Partial Partial
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.
10 CVE-2020-5504 89 Sql 2020-01-09 2020-11-10
6.5
 None Remote Low ??? Partial Partial Partial
In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.
11 CVE-2019-19617 2019-12-06 2020-11-10
7.5
 None Remote Low Not required Partial Partial Partial
phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.
12 CVE-2019-18622 89 Sql 2019-11-22 2020-01-14
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature.
13 CVE-2019-12922 352 CSRF 2019-09-13 2019-09-28
5.8
 None Remote Medium Not required None Partial Partial
A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.
14 CVE-2019-12616 352 CSRF 2019-06-05 2019-06-14
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim.
15 CVE-2019-11768 89 Sql 2019-06-05 2019-06-14
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature.
16 CVE-2019-6799 2019-01-26 2020-08-24
4.3
 None Remote Medium Not required Partial None None
An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of "options(MYSQLI_OPT_LOCAL_INFILE" calls.
17 CVE-2019-6798 89 Sql 2019-01-26 2019-01-28
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature.
18 CVE-2018-19970 79 XSS 2018-12-11 2019-04-22
4.3
 None Remote Medium Not required None Partial None
In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name.
19 CVE-2018-19969 352 CSRF 2018-12-11 2019-04-22
6.8
 None Remote Medium Not required Partial Partial Partial
phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes, etc.
20 CVE-2018-19968 200 +Info 2018-12-11 2019-04-23
4.0
 None Remote Low ??? Partial None None
An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.
21 CVE-2018-15605 79 XSS 2018-08-24 2018-10-26
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature.
22 CVE-2018-12613 287 Exec Code Bypass 2018-06-21 2021-11-02
6.5
 None Remote Low ??? Partial Partial Partial
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication).
23 CVE-2018-12581 79 XSS 2018-06-21 2018-08-10
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature.
24 CVE-2018-7260 79 XSS 2018-02-21 2018-03-06
3.5
 None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
25 CVE-2017-1000499 352 CSRF 2018-01-03 2019-04-30
6.8
 None Remote Medium Not required Partial Partial Partial
phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.
26 CVE-2017-1000018 20 2017-07-17 2019-03-20
5.0
 None Remote Low Not required None None Partial
phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table name
27 CVE-2017-1000017 918 2017-07-17 2019-03-25
6.5
 None Remote Low ??? Partial Partial Partial
phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL server
28 CVE-2017-18264 Bypass 2018-05-01 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The restrictions caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are bypassed under certain PHP versions (e.g., version 5). This can allow the login of users who have no password set even if the administrator has set $cfg['Servers'][$i]['AllowNoPassword'] to false (which is also the default). This occurs because some implementations of the PHP substr function return false when given '' as the first argument.
29 CVE-2016-6621 918 2017-01-31 2018-07-08
5.0
 None Remote Low Not required Partial None None
The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
30 CVE-2016-5097 200 +Info 2016-07-05 2018-10-30
5.0
 None Remote Low Not required Partial None None
phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs.
31 CVE-2014-1879 79 XSS 2014-02-20 2015-08-05
3.5
 None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action.
32 CVE-2011-2642 79 XSS 2011-08-01 2017-08-29
2.6
 None Remote High Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the table Print view implementation in tbl_printview.php in phpMyAdmin before 3.3.10.3 and 3.4.x before 3.4.3.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name.
33 CVE-2010-4481 287 Bypass +Info 2010-12-17 2011-01-28
5.0
 None Remote Low Not required Partial None None
phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to phpinfo.php, which calls the phpinfo function.
34 CVE-2009-2284 79 XSS 2009-07-01 2009-08-07
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in phpMyAdmin before 3.2.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted SQL bookmark.
35 CVE-2009-1151 94 2009-03-26 2018-10-10
7.5
 None Remote Low Not required Partial Partial Partial
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
36 CVE-2009-1149 20 Http R.Spl. 2009-03-26 2009-04-16
7.5
 None Remote Low Not required Partial Partial Partial
CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the (1) c_type and possibly (2) file_type parameters.
37 CVE-2009-1148 22 Dir. Trav. 2009-03-26 2009-04-16
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to read arbitrary files via directory traversal sequences in the file_path parameter ($filename variable).
38 CVE-2008-4096 20 Exec Code 2008-09-18 2017-08-08
8.5
 None Remote Medium ??? Complete Complete Complete
libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by parameter containing PHP sequences, which are processed by create_function.
39 CVE-2008-3457 79 XSS 2008-08-04 2017-08-08
2.6
 None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php.
40 CVE-2008-3456 59 2008-08-04 2017-08-08
6.4
 None Remote Low Not required None Partial Partial
phpMyAdmin before 2.11.8 does not sufficiently prevent its pages from using frames that point to pages in other domains, which makes it easier for remote attackers to conduct spoofing or phishing activities via a cross-site framing attack.
41 CVE-2008-1924 200 +Info 2008-04-23 2017-08-08
3.5
 None Remote Medium ??? Partial None None
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
42 CVE-2008-1149 352 Sql CSRF 2008-03-04 2017-08-08
5.1
 None Remote High Not required Partial Partial Partial
phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies.
43 CVE-2007-6100 79 XSS 2007-11-23 2017-07-29
2.6
 None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in libraries/auth/cookie.auth.lib.php in phpMyAdmin before 2.11.2.2, when logins are authenticated with the cookie auth_type, allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter to index.php, a different vulnerability than CVE-2005-0992.
44 CVE-2007-5977 79 XSS 2007-11-15 2017-07-29
3.5
 None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than CVE-2006-6942.
45 CVE-2007-5976 89 Exec Code Sql 2007-11-15 2017-07-29
6.5
 None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to execute arbitrary SQL commands via the db parameter.
46 CVE-2007-5589 79 XSS 2007-10-19 2017-08-17
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in (1) PHP_SELF in (a) server_status.php, and (b) grab_globals.lib.php, (c) display_change_password.lib.php, and (d) common.lib.php in libraries/; and certain input available in PHP_SELF and (2) PATH_INFO in libraries/common.inc.php. NOTE: there might also be other vectors related to (3) REQUEST_URI.
47 CVE-2007-1325 DoS 2007-03-07 2011-03-08
7.1
 None Remote Medium Not required None None Complete
The PMA_ArrayWalkRecursive function in libraries/common.lib.php in phpMyAdmin before 2.10.0.2 does not limit recursion on arrays provided by users, which allows context-dependent attackers to cause a denial of service (web server crash) via an array with many dimensions. NOTE: it could be argued that this vulnerability is caused by a problem in PHP (CVE-2006-1549) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in phpMyAdmin.
48 CVE-2007-0204 XSS 2007-01-11 2017-07-29
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.9.2-rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information.
49 CVE-2007-0203 2007-01-11 2011-03-08
10.0
 None Remote Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in phpMyAdmin before 2.9.2-rc1 have unknown impact and attack vectors.
50 CVE-2006-6944 Bypass 2007-01-19 2011-03-08
7.5
 None Remote Low Not required Partial Partial Partial
phpMyAdmin before 2.9.1.1 allows remote attackers to bypass Allow/Deny access rules that use IP addresses via false headers.
Total number of vulnerabilities : 54   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.