PH
Product
phpMyAdmin
On CISA KEVExploited in the wild
270
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 15High 30Medium 73Low 1
Watch
Add phpMyAdmin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-9851 | 5.3 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.4.0; 4.4.1; 4.4.1.1; 4.4.2; 4.4.3; 4.4.4; +27 more |
| CVE-2016-9850 | 5.3 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.6.4; 4.4.0; +34 more |
| CVE-2016-9848 | 5.3 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.4.0; 4.4.1; 4.4.1.1; 4.4.2; 4.4.3; 4.4.4; +34 more |
| CVE-2016-9847 | 5.3 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.6.4; 4.0.0; +34 more |
| CVE-2016-6627 | 5.3 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.4.1; +34 more |
| CVE-2016-6613 | 5.3 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.4.0; 4.4.1; 4.4.1.1; 4.4.2; 4.4.3; 4.4.4; +34 more |
| CVE-2016-5098 | 5.3 | Jul 5 | Directory traversal vulnerability in libraries/error_report.lib.php in phpMyAdmin before 4.6.2-prerelease allows remote attackers to determine the existence of arbitrary files by… Affected: 4.6.2 |
| CVE-2016-5097 | 5.3 | Jul 5 | phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive… Affected: through 4.6.1 |
| CVE-2016-5730 | 5.3 | Jul 3 | phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.4.1; +34 more |
| CVE-2016-2044 | 5.3 | Feb 20 | libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals… Affected: 4.5.0; 4.5.0.1; 4.5.0.2; 4.5.1; 4.5.2; 4.5.3 |
| CVE-2016-2042 | 5.3 | Feb 20 | phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to (1) libraries/phpseclib/Crypt/AES.php or… Affected: 4.4.1; 4.4.1.1; 4.4.2; 4.4.3; 4.4.4; 4.4.5; +21 more |
| CVE-2016-2039 | 5.3 | Feb 20 | libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.10; 4.0.10.1; +34 more |
| CVE-2016-2038 | 5.3 | Feb 20 | phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.10; 4.0.10.1; +34 more |
| CVE-2015-8669 | 5.3 | Dec 26 | libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensitive information via… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.4.1; +34 more |
| CVE-2016-4412 | 4.4 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.4.1; +22 more |
| CVE-2022-23807 | 4.3 | Jan 22 | An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2 Affected: 4.9.0 before 4.9.8; 5.1.0 before 5.1.2 |
| CVE-2016-6625 | 4.3 | Dec 11 | An issue was discovered in phpMyAdmin Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.4.1; +34 more |
| CVE-2016-6610 | 4.3 | Dec 11 | A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error in the export mechanism to discover the full path of phpMyAdmin on… Affected: 4.4.0; 4.4.1; 4.4.1.1; 4.4.2; 4.4.3; 4.4.4; +34 more |
| CVE-2016-5702 | 3.7 | Jul 3 | phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI Affected: 4.6.0; 4.6.0; 4.6.0; 4.6.0; 4.6.1; 4.6.2 |
| CVE-2015-7873 | – | Oct 28 | The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter Affected: 4.4.0; 4.4.1; 4.4.1.1; 4.4.2; 4.4.3; 4.4.4; +17 more |
| CVE-2015-6830 | – | Sep 14 | libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha… Affected: 4.3.0; 4.3.1; 4.3.2; 4.3.3; 4.3.4; 4.3.5; +25 more |
| CVE-2015-3903 | – | May 26 | libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +34 more |
| CVE-2015-3902 | – | May 26 | Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +34 more |
| CVE-2015-2206 | – | Mar 9 | libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +34 more |
| CVE-2011-3592 | – | Dec 26 | Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject… Affected: 3.4.0.0; 3.4.1.0; 3.4.2.0; 3.4.3.0; 3.4.3.1; 3.4.3.2; +1 more |
| CVE-2011-3591 | – | Dec 26 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that… Affected: 3.4.0.0; 3.4.1.0; 3.4.2.0; 3.4.3.0; 3.4.3.1; 3.4.3.2; +1 more |
| CVE-2014-9219 | – | Dec 8 | Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 allows remote attackers to inject arbitrary web script or HTML… Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5; +12 more |
| CVE-2014-9218 | – | Dec 8 | libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service (resource… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +34 more |
| CVE-2014-8961 | – | Nov 30 | Directory traversal vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote… Affected: 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; +29 more |
| CVE-2014-8960 | – | Nov 30 | Cross-site scripting (XSS) vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote… Affected: 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; +29 more |
| CVE-2014-8959 | – | Nov 30 | Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +34 more |
| CVE-2014-8958 | – | Nov 30 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.4.1; +34 more |
| CVE-2014-6300 | – | Nov 8 | Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +34 more |
| CVE-2014-8326 | – | Nov 5 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +34 more |
| CVE-2014-7217 | – | Oct 3 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 allow remote authenticated users to inject… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +34 more |
| CVE-2014-5274 | – | Aug 22 | Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject… Affected: 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; +19 more |
| CVE-2014-5273 | – | Aug 22 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +34 more |
| CVE-2014-4987 | – | Jul 20 | server_user_groups.php in phpMyAdmin 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6 allows remote authenticated users to bypass intended access restrictions and read the MySQL user… Affected: 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; +16 more |
| CVE-2014-4986 | – | Jul 20 | Multiple cross-site scripting (XSS) vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allow remote… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +32 more |
| CVE-2014-4955 | – | Jul 20 | Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function in libraries/rte/rte_list.lib.php in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +32 more |
| CVE-2014-4954 | – | Jul 20 | Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated… Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5 |
| CVE-2014-4349 | – | Jun 25 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or… Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.1.0; 4.1.1; +13 more |
| CVE-2014-4348 | – | Jun 25 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1)… Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.3 |
| CVE-2014-1879 | – | Feb 20 | Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename… Affected: through 4.1.6; 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2013-5029 | – | Aug 19 | phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php Affected: 3.5.0.0; 3.5.1.0; 3.5.2.0; 3.5.2.1; 3.5.2.2; 3.5.3.0; +18 more |
| CVE-2013-5003 | – | Jul 31 | Multiple SQL injection vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote authenticated users to execute arbitrary SQL commands via (1) the… Affected: 3.5.0.0; 3.5.1.0; 3.5.2.0; 3.5.2.1; 3.5.2.2; 3.5.3.0; +16 more |
| CVE-2013-5002 | – | Jul 31 | Cross-site scripting (XSS) vulnerability in libraries/schema/Export_Relation_Schema.class.php in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote… Affected: 3.5.0.0; 3.5.1.0; 3.5.2.0; 3.5.2.1; 3.5.2.2; 3.5.3.0; +16 more |
| CVE-2013-5001 | – | Jul 31 | Cross-site scripting (XSS) vulnerability in libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php in phpMyAdmin 4.0.x before 4.0.4.2 allows remote… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +2 more |
| CVE-2013-5000 | – | Jul 31 | phpMyAdmin 3.5.x before 3.5.8.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to… Affected: 3.5.0.0; 3.5.1.0; 3.5.2.0; 3.5.2.1; 3.5.2.2; 3.5.3.0; +8 more |
| CVE-2013-4999 | – | Jul 31 | phpMyAdmin 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +2 more |