PH
Product
phpMyAdmin
On CISA KEVExploited in the wild
270
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 15High 30Medium 73Low 1
Watch
Add phpMyAdmin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2013-4998 | – | Jul 31 | phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an… Affected: 3.5.0.0; 3.5.1.0; 3.5.2.0; 3.5.2.1; 3.5.2.2; 3.5.3.0; +16 more |
| CVE-2013-4997 | – | Jul 31 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a… Affected: 3.5.0.0; 3.5.1.0; 3.5.2.0; 3.5.2.1; 3.5.2.2; 3.5.3.0; +8 more |
| CVE-2013-4996 | – | Jul 31 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote attackers to inject arbitrary web script or HTML via… Affected: 3.5.0.0; 3.5.1.0; 3.5.2.0; 3.5.2.1; 3.5.2.2; 3.5.3.0; +16 more |
| CVE-2013-4995 | – | Jul 31 | Cross-site scripting (XSS) vulnerability in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a… Affected: 3.5.0.0; 3.5.1.0; 3.5.2.0; 3.5.2.1; 3.5.2.2; 3.5.3.0; +16 more |
| CVE-2013-4729 | – | Jul 4 | import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +1 more |
| CVE-2013-3742 | – | Jul 4 | Cross-site scripting (XSS) vulnerability in view_create.php (aka the Create View page) in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2 |
| CVE-2013-3241 | – | Apr 26 | export.php (aka the export script) in phpMyAdmin 4.x before 4.0.0-rc3 overwrites global variables on the basis of the contents of the POST superglobal array, which allows remote… Affected: 4.0.0 |
| CVE-2013-3240 | – | Apr 26 | Directory traversal vulnerability in the Export feature in phpMyAdmin 4.x before 4.0.0-rc3 allows remote authenticated users to read arbitrary files or possibly have unspecified… Affected: 4.0.0 |
| CVE-2013-3239 | – | Apr 26 | phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double… Affected: 3.5.0.0; 3.5.1.0; 3.5.2.0; 3.5.2.1; 3.5.2.2; 3.5.3.0; +7 more |
| CVE-2013-3238 | – | Apr 26 | phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not properly handled before… Affected: 3.5.0.0; 3.5.1.0; 3.5.2.0; 3.5.2.1; 3.5.2.2; 3.5.3.0; +7 more |
| CVE-2012-5469 | – | Dec 20 | The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console access via a direct request to… Affected: 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +23 more |
| CVE-2012-5368 | – | Oct 25 | phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct… Affected: 3.5.0.0; 3.5.1.0; 3.5.2.0; 3.5.2.1; 3.5.2.2 |
| CVE-2012-5339 | – | Oct 25 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of… Affected: 3.5.0.0; 3.5.1.0; 3.5.2.0; 3.5.2.1; 3.5.2.2 |
| CVE-2012-5159 | – | Sep 25 | phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modification (Trojan Horse) in… Affected: 3.5.2.2 |
| CVE-2012-4579 | – | Aug 21 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via a Table… Affected: 3.5.0.0; 3.5.1.0; 3.5.2.0; 3.5.2.1 |
| CVE-2012-4345 | – | Aug 21 | Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to… Affected: 3.4.0.0; 3.4.1.0; 3.4.2.0; 3.4.3.0; 3.4.3.1; 3.4.3.2; +15 more |
| CVE-2012-4219 | – | Aug 21 | show_config_errors.php in phpMyAdmin 3.5.x before 3.5.2.1 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an… Affected: 3.5.0.0; 3.5.1.0; 3.5.2.0 |
| CVE-2012-1190 | – | May 3 | Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication.js in phpMyAdmin 3.4.x before 3.4.10.1 allows user-assisted remote attackers to… Affected: 3.4.0.0; 3.4.1.0; 3.4.2.0; 3.4.3.0; 3.4.3.1; 3.4.3.2; +9 more |
| CVE-2012-1902 | – | Apr 6 | show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request,… Affected: 3.4.0.0; 3.4.1.0; 3.4.2.0; 3.4.3.0; 3.4.3.1; 3.4.3.2; +9 more |
| CVE-2011-1941 | – | Jan 26 | Open redirect vulnerability in the redirector feature in phpMyAdmin 3.4.x before 3.4.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing… Affected: 3.4.0.0 |
| CVE-2011-1940 | – | Jan 26 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.3.x before 3.3.10.1 and 3.4.x before 3.4.1 allow remote attackers to inject arbitrary web script or HTML via a… Affected: 3.3.0.0; 3.3.1.0; 3.3.2.0; 3.3.3.0; 3.3.4.0; 3.3.5.0; +10 more |
| CVE-2011-4782 | – | Dec 22 | Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote attackers to inject… Affected: 3.4.0.0; 3.4.1.0; 3.4.2.0; 3.4.3.0; 3.4.3.1; 3.4.3.2; +5 more |
| CVE-2011-4780 | – | Dec 22 | Multiple cross-site scripting (XSS) vulnerabilities in libraries/display_export.lib.php in phpMyAdmin 3.4.x before 3.4.9 allow remote attackers to inject arbitrary web script or… Affected: 3.4.0.0; 3.4.1.0; 3.4.2.0; 3.4.3.0; 3.4.3.1; 3.4.3.2; +5 more |
| CVE-2011-4634 | – | Dec 22 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.8 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted database name,… Affected: 3.4.0.0; 3.4.1.0; 3.4.2.0; 3.4.3.0; 3.4.3.1; 3.4.3.2; +4 more |
| CVE-2011-3646 | – | Nov 17 | phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to obtain sensitive information via an array-typed js_frame parameter to phpmyadmin.css.php, which… Affected: 3.4.0.0; 3.4.1.0; 3.4.2.0; 3.4.3.0; 3.4.3.1; 3.4.3.2; +2 more |
| CVE-2011-4064 | – | Nov 1 | Cross-site scripting (XSS) vulnerability in the setup interface in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to inject arbitrary web script or HTML via a crafted value Affected: 3.4.0.0; 3.4.1.0; 3.4.2.0; 3.4.3.0; 3.4.3.1; 3.4.3.2; +2 more |
| CVE-2011-3181 | – | Aug 29 | Multiple cross-site scripting (XSS) vulnerabilities in the Tracking feature in phpMyAdmin 3.3.x before 3.3.10.4 and 3.4.x before 3.4.4 allow remote attackers to inject arbitrary… Affected: 3.3.0.0; 3.3.1.0; 3.3.2.0; 3.3.3.0; 3.3.4.0; 3.3.5.0; +18 more |
| CVE-2011-2719 | – | Aug 1 | libraries/auth/swekey/swekey.auth.lib.php in phpMyAdmin 3.x before 3.3.10.3 and 3.4.x before 3.4.3.2 does not properly manage sessions associated with Swekey authentication, which… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.1; 3.0.1; +34 more |
| CVE-2011-2718 | – | Aug 1 | Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote authenticated users to include and execute… Affected: 3.4.0.0; 3.4.1.0; 3.4.2.0; 3.4.3.0; 3.4.3.1 |
| CVE-2011-2643 | – | Aug 1 | Directory traversal vulnerability in sql.php in phpMyAdmin 3.4.x before 3.4.3.2, when configuration storage is enabled, allows remote attackers to include and execute arbitrary… Affected: 3.4.0.0; 3.4.1.0; 3.4.2.0; 3.4.3.0; 3.4.3.1 |
| CVE-2011-2642 | – | Aug 1 | Multiple cross-site scripting (XSS) vulnerabilities in the table Print view implementation in tbl_printview.php in phpMyAdmin before 3.3.10.3 and 3.4.x before 3.4.3.2 allow remote… Affected: through 3.3.10.2; 2.11.0; 2.11.1.0; 2.11.1.1; 2.11.1.2; 2.11.2.0; +34 more |
| CVE-2011-2508 | – | Jul 14 | Directory traversal vulnerability in libraries/display_tbl.lib.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1, when a certain MIME transformation feature is… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.1; 3.0.1; +34 more |
| CVE-2011-2507 | – | Jul 14 | libraries/server_synchronize.lib.php in the Synchronize implementation in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly quote regular expressions,… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.1; 3.0.1; +34 more |
| CVE-2011-2506 | – | Jul 14 | setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.1; 3.0.1; +34 more |
| CVE-2011-2505 | – | Jul 14 | libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.1; 3.0.1; +34 more |
| CVE-2011-0987 | – | Feb 14 | The PMA_Bookmark_get function in libraries/bookmark.lib.php in phpMyAdmin 2.11.x before 2.11.11.3, and 3.3.x before 3.3.9.2, does not properly restrict bookmark queries, which… Affected: 2.11.0; 2.11.1.0; 2.11.1.1; 2.11.1.2; 2.11.2.0; 2.11.2.1; +34 more |
| CVE-2011-0986 | – | Feb 14 | phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote… Affected: 2.11.0; 2.11.1.0; 2.11.1.1; 2.11.1.2; 2.11.2.0; 2.11.2.1; +34 more |
| CVE-2010-4481 | – | Dec 17 | phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to phpinfo.php, which calls the phpinfo… Affected: through 3.3.9.0; 2.11.0; 2.11.1.0; 2.11.1.1; 2.11.1.2; 2.11.2.0; +34 more |
| CVE-2010-4480 | – | Dec 8 | error.php in PhpMyAdmin 3.3.8.1, and other versions before 3.4.0-beta1, allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted BBcode tag containing… Affected: 3.3.8.1; 3.3.9.0 |
| CVE-2010-4329 | – | Dec 2 | Cross-site scripting (XSS) vulnerability in the PMA_linkOrButton function in libraries/common.lib.php in the database (db) search script in phpMyAdmin 2.11.x before 2.11.11.1 and… Affected: 2.11.0; 2.11.1.0; 2.11.1.1; 2.11.1.2; 2.11.2.0; 2.11.2.1; +34 more |
| CVE-2010-3263 | – | Sep 10 | Cross-site scripting (XSS) vulnerability in setup/frames/index.inc.php in the setup script in phpMyAdmin 3.x before 3.3.7 allows remote attackers to inject arbitrary web script or… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.1; 3.0.1; +30 more |
| CVE-2010-2958 | – | Sep 8 | Cross-site scripting (XSS) vulnerability in libraries/Error.class.php in phpMyAdmin 3.x before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via vectors… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.1; 3.0.1; +29 more |
| CVE-2010-3056 | – | Aug 24 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.11.x before 2.11.10.1 and 3.x before 3.3.5.1 allow remote attackers to inject arbitrary web script or HTML via… Affected: 2.11.0; 2.11.1.0; 2.11.1.1; 2.11.1.2; 2.11.2.0; 2.11.2.1; +34 more |
| CVE-2010-3055 | – | Aug 24 | The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers… Affected: 2.11.0; 2.11.1.0; 2.11.1.1; 2.11.1.2; 2.11.2.0; 2.11.2.1; +18 more |
| CVE-2009-4605 | – | Jan 19 | scripts/setup.php (aka the setup script) in phpMyAdmin 2.11.x before 2.11.10 calls the unserialize function on the values of the (1) configuration and (2) v[0] parameters, which… Affected: 2.11.0; 2.11.1.0; 2.11.1.1; 2.11.1.2; 2.11.2.0; 2.11.2.1; +17 more |
| CVE-2008-7252 | – | Jan 19 | libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 uses predictable filenames for temporary files, which has unknown impact and attack vectors Affected: 2.11.0; 2.11.0; 2.11.0; 2.11.0.0; 2.11.0beta1; 2.11.0rc1; +34 more |
| CVE-2008-7251 | – | Jan 19 | libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 creates a temporary directory with 0777 permissions, which has unknown impact and attack vectors Affected: 2.11.0; 2.11.0; 2.11.0; 2.11.0.0; 2.11.0beta1; 2.11.0rc1; +34 more |
| CVE-2009-3697 | – | Oct 16 | SQL injection vulnerability in the PDF schema generator functionality in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to execute arbitrary SQL… Affected: 2.11.0; 2.11.0; 2.11.0; 2.11.0.0; 2.11.0beta1; 2.11.1; +34 more |
| CVE-2009-3696 | – | Oct 16 | Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to inject arbitrary web script or HTML via a crafted… Affected: 2.11.0; 2.11.0; 2.11.0; 2.11.0.0; 2.11.0beta1; 2.11.1; +34 more |
| CVE-2009-2284 | – | Jul 1 | Cross-site scripting (XSS) vulnerability in phpMyAdmin before 3.2.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted SQL bookmark Affected: through 3.2.0; 2.0; 2.0.0; 2.0.1; 2.0.2; 2.0.3; +34 more |