PH
Product
phpMyAdmin
On CISA KEVExploited in the wild
270
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 15High 30Medium 73Low 1
Watch
Add phpMyAdmin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2009-1285 | – | Apr 16 | Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows remote attackers to inject arbitrary… Affected: 3.0.0; 3.0.1; 3.1.0; 3.1.0.0; 3.1.1; 3.1.1; +6 more |
| CVE-2009-1150 | – | Mar 26 | Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allow remote attackers… Affected: 2.11.0; 2.11.0; 2.11.0; 2.11.1; 2.11.1; 2.11.1.0; +34 more |
| CVE-2009-1149 | – | Mar 26 | CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to inject arbitrary HTTP headers and… Affected: through 3.1.3; 3.1.0; 3.1.0.0; 3.1.1; 3.1.1; 3.1.2; +2 more |
| CVE-2009-1148 | – | Mar 26 | Directory traversal vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to read arbitrary files via… Affected: through 3.1.3; 3.1.0; 3.1.0.0; 3.1.1; 3.1.1; 3.1.2; +2 more |
| CVE-2008-5621 | – | Dec 17 | Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the… Affected: 2.11.0; 2.11.0.0; 2.11.1; 2.11.1.0; 2.11.1.1; 2.11.1.2; +21 more |
| CVE-2008-4775 | – | Oct 28 | Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when register_globals is enabled, allows… Affected: 2.11.9.2; 3.0.0; 3.0.1 |
| CVE-2008-4326 | – | Sep 30 | The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site… Affected: through 2.11.9.1; 2.0; 2.0.0; 2.0.1; 2.0.2; 2.0.3; +34 more |
| CVE-2008-4096 | – | Sep 18 | libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by… Affected: through 2.11.9; 2.0; 2.0.0; 2.0.1; 2.0.2; 2.0.3; +34 more |
| CVE-2008-3457 | – | Aug 4 | Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup… Affected: through 2.11.7.0; 2.0; 2.0.0; 2.0.1; 2.0.2; 2.0.3; +34 more |
| CVE-2008-3456 | – | Aug 4 | phpMyAdmin before 2.11.8 does not sufficiently prevent its pages from using frames that point to pages in other domains, which makes it easier for remote attackers to conduct… Affected: through 2.11.7.0; 2.0; 2.0.0; 2.0.1; 2.0.2; 2.0.3; +34 more |
| CVE-2008-3197 | – | Jul 16 | Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1 allows remote attackers to perform unauthorized actions via a link or IMG tag to (1) the db parameter… Affected: 2.0; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2008-2960 | – | Jul 2 | Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.11.7, when register_globals is enabled and .htaccess support is disabled, allows remote attackers to inject… Affected: 2.10.0; 2.10.0.1; 2.10.0.2; 2.10.1; 2.10.2; 2.10.3; +21 more |
| CVE-2008-1924 | – | Apr 23 | Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via… Affected: through 2.11.5.1; 2.10.0; 2.10.0.1; 2.10.0.2; 2.10.1; 2.10.2; +18 more |
| CVE-2008-1149 | – | Mar 4 | phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and… Affected: through 2.11.4; 2.11.0; 2.11.0; 2.11.0; 2.11.0.0; 2.11.1; +12 more |
| CVE-2007-6100 | – | Nov 23 | Cross-site scripting (XSS) vulnerability in libraries/auth/cookie.auth.lib.php in phpMyAdmin before 2.11.2.2, when logins are authenticated with the cookie auth_type, allows… Affected: through 2.11.2.1; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2007-5977 | – | Nov 15 | Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web… Affected: through 2.11.2 |
| CVE-2007-5976 | – | Nov 15 | SQL injection vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to execute arbitrary SQL commands via… Affected: through 2.11.2 |
| CVE-2007-5589 | – | Oct 19 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in (1)… Affected: through 2.11.1.1 |
| CVE-2007-5386 | – | Oct 12 | Cross-site scripting (XSS) vulnerability in scripts/setup.php in phpMyAdmin 2.11.1, when accessed by a browser that does not URL-encode requests, allows remote attackers to inject… Affected: 2.11.1 |
| CVE-2007-4306 | – | Aug 13 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.10.3 allow remote attackers to inject arbitrary web script or HTML via the (1) unlim_num_rows, (2) sql_query,… Affected: 2.10.3 |
| CVE-2007-2245 | – | Apr 25 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.10.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the fieldkey parameter to… Affected: 2.10.1.0 |
| CVE-2007-2016 | – | Apr 12 | Cross-site scripting (XSS) vulnerability in mysql/phpinfo.php in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary web script or HTML via the lang[] parameter Affected: 2.6.1 |
| CVE-2007-1395 | – | Mar 10 | Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by injecting arbitrary… Affected: 2.8.0; 2.8.0.1; 2.8.0.2; 2.8.0.3; 2.8.1; 2.8.1_dev; +16 more |
| CVE-2007-1325 | – | Mar 7 | The PMA_ArrayWalkRecursive function in libraries/common.lib.php in phpMyAdmin before 2.10.0.2 does not limit recursion on arrays provided by users, which allows context-dependent… Affected: through 2.10.0.1 |
| CVE-2006-6944 | – | Jan 19 | phpMyAdmin before 2.9.1.1 allows remote attackers to bypass Allow/Deny access rules that use IP addresses via false headers Affected: through 2.9.1; 2.9.0; 2.9.0.1; 2.9.0.2; 2.9.0.3; 2.9.0_beta1; +3 more |
| CVE-2006-6943 | – | Jan 19 | PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to (a) scripts/check_lang.php and (b) themes/darkblue_orange/layout.inc.php;… Affected: through 2.9.1; 2.9.0; 2.9.0.1; 2.9.0.2; 2.9.0.3; 2.9.0_beta1; +3 more |
| CVE-2006-6942 | – | Jan 19 | Multiple cross-site scripting (XSS) vulnerabilities in PhpMyAdmin before 2.9.1.1 allow remote attackers to inject arbitrary HTML or web script via (1) a comment for a table name,… Affected: through 2.9.1; 2.9.0; 2.9.0.1; 2.9.0.2; 2.9.0.3; 2.9.0_beta1; +3 more |
| CVE-2007-0341 | – | Jan 18 | Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.1 and earlier, when Microsoft Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or… Affected: 2.8.1 |
| CVE-2007-0204 | – | Jan 11 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.9.2-rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 2.9.1.1 |
| CVE-2007-0203 | – | Jan 11 | Multiple unspecified vulnerabilities in phpMyAdmin before 2.9.2-rc1 have unknown impact and attack vectors Affected: through 2.9.1.1 |
| CVE-2007-0095 | – | Jan 5 | phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a direct request for themes/darkblue_orange/layout.inc.php, which reveals the path in an error… Affected: 2.9.1.1 |
| CVE-2006-6374 | – | Dec 7 | Multiple CRLF injection vulnerabilities in PhpMyAdmin 2.7.0-pl2 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF… Affected: 2.7.0_pl2 |
| CVE-2006-6373 | – | Dec 7 | PhpMyAdmin 2.7.0-pl2 allows remote attackers to obtain sensitive information via a direct request for libraries/common.lib.php, which reveals the path in an error message Affected: 2.7.0_pl2 |
| CVE-2006-5718 | – | Nov 4 | Cross-site scripting (XSS) vulnerability in error.php in phpMyAdmin 2.6.4 through 2.9.0.2 allows remote attackers to inject arbitrary web script or HTML via UTF-7 or US-ASCII… Affected: 2.6.4_pl1; 2.6.4_pl3; 2.6.4_pl4; 2.6.4_rc1; 2.7; 2.7.0_beta1; +9 more |
| CVE-2006-5117 | – | Oct 3 | phpMyAdmin before 2.9.1-rc1 has a libraries directory under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information… Affected: 2.8.0.1; 2.8.0.2; 2.8.0.3; 2.8.1; 2.8.1_dev; 2.8.3; +2 more |
| CVE-2006-5116 | – | Oct 3 | Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by (1) directly… Affected: 2.8.0.1; 2.8.0.2; 2.8.0.3; 2.8.1; 2.8.1_dev; 2.8.3; +2 more |
| CVE-2006-3388 | – | Jul 6 | Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the table parameter Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2006-2418 | – | May 16 | Cross-site scripting (XSS) vulnerabilities in certain versions of phpMyAdmin before 2.8.0.4 allow remote attackers to inject arbitrary web script or HTML via the db parameter in… Affected: 2.8.0.3 |
| CVE-2006-2417 | – | May 16 | Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.x before 2.8.0.4 allows remote attackers to inject arbitrary web script or HTML via the theme parameter in unknown… Affected: 2.8.0.1; 2.8.0.2; 2.8.0.3 |
| CVE-2006-2031 | – | Apr 26 | Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin 2.8.0.3, 2.8.0.2, 2.8.1-dev, and 2.9.0-dev allows remote attackers to inject arbitrary web script or HTML via… Affected: 2.8.0.2; 2.8.0.3; 2.8.1_dev; 2.9.0_dev |
| CVE-2006-1804 | – | Apr 18 | SQL injection vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to execute arbitrary SQL commands via the sql_query parameter Affected: 2.7.0_pl1; 2.8.0.3 |
| CVE-2006-1803 | – | Apr 18 | Cross-site scripting (XSS) vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to inject arbitrary web script or HTML via the sql_query parameter Affected: through 2.8.0.3 |
| CVE-2006-1678 | – | Apr 11 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.8.0.3 allow remote attackers to inject arbitrary web script or HTML via unknown vectors in unspecified… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2006-1258 | – | Mar 19 | Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.1 allows remote attackers to inject arbitrary web script or HTML via the set_theme parameter Affected: 2.8.0.1 |
| CVE-2005-4450 | – | Dec 21 | Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.7.0 allows remote attackers to perform unauthorized actions as a logged-in user via a link or IMG tag to… Affected: 2.7.0_pl1 |
| CVE-2005-3665 | – | Dec 8 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_HOST variable and (2)… Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2005-4079 | – | Dec 8 | The register_globals emulation in phpMyAdmin 2.7.0 rc1 allows remote attackers to exploit other vulnerabilities in phpMyAdmin by modifying the import_blacklist variable in… Affected: 2.7.0_rc1 |
| CVE-2005-3787 | – | Nov 24 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-pl4 allow remote attackers to inject arbitrary web script or HTML via (1) the cookie-based login… Affected: 2.2.0; 2.2.7_pl1; 2.5.2_pl1; 2.5.3; 2.5.4; 2.5.5_pl1; +7 more |
| CVE-2005-3622 | – | Nov 16 | phpMyAdmin 2.7.0-beta1 and earlier allows remote attackers to obtain the full path of the server via direct requests to multiple scripts in the libraries directory Affected: 2.2.0; 2.2.7_pl1; 2.5.2_pl1; 2.5.3; 2.5.4; 2.5.5_pl1; +9 more |
| CVE-2005-3621 | – | Nov 16 | CRLF injection vulnerability in phpMyAdmin before 2.6.4-pl4 allows remote attackers to conduct HTTP response splitting attacks via unspecified scripts Affected: 2.2.0; 2.2.7_pl1; 2.5.2_pl1; 2.5.3; 2.5.4; 2.5.5_pl1; +7 more |