PH
Product
phpMyAdmin
On CISA KEVExploited in the wild
270
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 15High 30Medium 73Low 1
Watch
Add phpMyAdmin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-6630 | 6.5 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.4.0; 4.4.1; +34 more |
| CVE-2016-6623 | 6.5 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.4.0; 4.4.1; 4.4.1.1; 4.4.2; 4.4.3; 4.4.4; +34 more |
| CVE-2016-6618 | 6.5 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.4.0; 4.4.1; +34 more |
| CVE-2016-6612 | 6.5 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.4.1; +34 more |
| CVE-2011-4107 | 6.5 | Nov 17 | The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated… Affected: 3.3.0.0 before 3.3.10.5; 3.4.0.0 before 3.4.7.1 |
| CVE-2016-6628 | 6.3 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.4.0; 4.4.1; 4.4.1.1; 4.4.2; 4.4.3; 4.4.4; +34 more |
| CVE-2005-4349 | 6.3 | Dec 19 | SQL injection vulnerability in server_privileges.php in phpMyAdmin 2.7.0 allows remote authenticated users to execute arbitrary SQL commands via the (1) dbname and (2) checkprivs… Affected: 2.7.0 |
| CVE-2022-23808 | 6.1 | Jan 22 | An issue was discovered in phpMyAdmin 5.1 before 5.1.2 Affected: 5.1.0 before 5.1.2 |
| CVE-2020-26934 | 6.1 | Oct 10 | phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link Affected: 4.9.0 before 4.9.6; 5.0.0 before 5.0.3 |
| CVE-2020-11441 | 6.1 | Mar 31 | phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page Affected: 5.0.2 |
| CVE-2018-19970 | 6.1 | Dec 11 | In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name Affected: 4.0.0 before 4.8.4 |
| CVE-2018-15605 | 6.1 | Aug 24 | An issue was discovered in phpMyAdmin before 4.8.3 Affected: before 4.8.3 |
| CVE-2018-12581 | 6.1 | Jun 21 | An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2 Affected: before 4.8.2 |
| CVE-2017-1000015 | 6.1 | Jul 17 | phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parameters Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +34 more |
| CVE-2017-1000013 | 6.1 | Jul 17 | phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +34 more |
| CVE-2016-9857 | 6.1 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.4.1; +34 more |
| CVE-2016-9856 | 6.1 | Dec 11 | An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10 Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.4.1; +34 more |
| CVE-2016-6615 | 6.1 | Dec 11 | XSS issues were discovered in phpMyAdmin Affected: 4.4.0; 4.4.1; 4.4.1.1; 4.4.2; 4.4.3; 4.4.4; +27 more |
| CVE-2016-6608 | 6.1 | Dec 11 | XSS issues were discovered in phpMyAdmin Affected: 4.6.0; 4.6.0; 4.6.0; 4.6.0; 4.6.1; 4.6.2; +1 more |
| CVE-2016-6607 | 6.1 | Dec 11 | XSS issues were discovered in phpMyAdmin Affected: 4.4.0; 4.4.1; 4.4.1.1; 4.4.2; 4.4.3; 4.4.4; +34 more |
| CVE-2016-5099 | 6.1 | Jul 5 | Cross-site scripting (XSS) vulnerability in phpMyAdmin 4.4.x before 4.4.15.6 and 4.6.x before 4.6.2 allows remote attackers to inject arbitrary web script or HTML via special… Affected: 4.4.0; 4.4.1; 4.4.1.1; 4.4.2; 4.4.3; 4.4.4; +23 more |
| CVE-2016-5733 | 6.1 | Jul 3 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.4.1; +34 more |
| CVE-2016-5732 | 6.1 | Jul 3 | Multiple cross-site scripting (XSS) vulnerabilities in the partition-range implementation in templates/table/structure/display_partitions.phtml in the table-structure page in… Affected: 4.6.0; 4.6.0; 4.6.0; 4.6.0; 4.6.1; 4.6.2 |
| CVE-2016-5731 | 6.1 | Jul 3 | Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to… Affected: 4.6.0; 4.6.0; 4.6.0; 4.6.0; 4.6.1; 4.6.2; +34 more |
| CVE-2016-5705 | 6.1 | Jul 3 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via… Affected: 4.6.0; 4.6.0; 4.6.0; 4.6.0; 4.6.1; 4.6.2; +25 more |
| CVE-2016-5704 | 6.1 | Jul 3 | Cross-site scripting (XSS) vulnerability in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors… Affected: 4.6.0; 4.6.0; 4.6.0; 4.6.0; 4.6.1; 4.6.2 |
| CVE-2016-5701 | 6.1 | Jul 3 | setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to conduct BBCode injection attacks… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.4.1; +34 more |
| CVE-2016-2560 | 6.1 | Mar 1 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.15, 4.4.x before 4.4.15.5, and 4.5.x before 4.5.5.1 allow remote attackers to inject… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.4.1; +34 more |
| CVE-2013-1937 | 6.1 | Apr 16 | Multiple cross-site scripting (XSS) vulnerabilities in tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or… Affected: through 3.5.8; 3.5.0.0; 3.5.1.0; 3.5.2.0; 3.5.2.1; 3.5.2.2; +6 more |
| CVE-2019-6799 | 5.9 | Jan 26 | An issue was discovered in phpMyAdmin before 4.8.5 Affected: 4.0.0 through 4.8.4 |
| CVE-2016-9860 | 5.9 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.6.4; 4.0.0; +34 more |
| CVE-2016-6632 | 5.9 | Dec 11 | An issue was discovered in phpMyAdmin where, under certain conditions, phpMyAdmin may not delete temporary files during the import of ESRI files Affected: 4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.0.0; 4.0.1; +34 more |
| CVE-2016-6624 | 5.9 | Dec 11 | An issue was discovered in phpMyAdmin involving improper enforcement of the IP-based authentication rules Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.4.1; +34 more |
| CVE-2016-6622 | 5.9 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.4.1; +34 more |
| CVE-2008-1567 | 5.5 | Mar 31 | phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password, and the (3) Blowfish secret key, in cleartext in a Session file under /tmp, which allows local users to… Affected: before 2.11.5.1 |
| CVE-2023-25727 | 5.4 | Feb 13 | In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface Affected: before 4.9.11; 5.0.0 before 5.2.1 |
| CVE-2020-10803 | 5.4 | Mar 22 | In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving… Affected: 4.0.0 before 4.9.5; 5.0.0 before 5.0.2 |
| CVE-2018-7260 | 5.4 | Feb 21 | Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a… Affected: before 4.7.8 |
| CVE-2016-6626 | 5.4 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.0.0; 4.0.1; +34 more |
| CVE-2016-2561 | 5.4 | Mar 1 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.5 and 4.5.x before 4.5.5.1 allow remote authenticated users to inject arbitrary web script or… Affected: 4.4.0; 4.4.1; 4.4.1.1; 4.4.2; 4.4.3; 4.4.4; +31 more |
| CVE-2016-2559 | 5.4 | Mar 1 | Cross-site scripting (XSS) vulnerability in the format function in libraries/sql-parser/src/Utils/Error.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.5.1 allows remote… Affected: 4.5.0; 4.5.0; 4.5.0; 4.5.0; 4.5.0.1; 4.5.0.2; +7 more |
| CVE-2016-2045 | 5.4 | Feb 20 | Cross-site scripting (XSS) vulnerability in the SQL editor in phpMyAdmin 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a SQL… Affected: 4.5.0; 4.5.0.1; 4.5.0.2; 4.5.1; 4.5.2; 4.5.3 |
| CVE-2016-2043 | 5.4 | Feb 20 | Cross-site scripting (XSS) vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote… Affected: 4.4.1; 4.4.1.1; 4.4.2; 4.4.3; 4.4.4; 4.4.5; +21 more |
| CVE-2016-2040 | 5.4 | Feb 20 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.10; 4.0.10.1; +34 more |
| CVE-2016-9859 | 5.3 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.4.0; 4.4.1; 4.4.1.1; 4.4.2; 4.4.3; 4.4.4; +34 more |
| CVE-2016-9858 | 5.3 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.4.0; 4.4.1; 4.4.1.1; 4.4.2; 4.4.3; 4.4.4; +34 more |
| CVE-2016-9855 | 5.3 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.4.0; 4.4.1; 4.4.1.1; 4.4.2; 4.4.3; 4.4.4; +27 more |
| CVE-2016-9854 | 5.3 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.4.0; 4.4.1; 4.4.1.1; 4.4.2; 4.4.3; 4.4.4; +27 more |
| CVE-2016-9853 | 5.3 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.4.0; 4.4.1; 4.4.1.1; 4.4.2; 4.4.3; 4.4.4; +27 more |
| CVE-2016-9852 | 5.3 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.6.4; 4.4.0; +27 more |