PH
Product
phpMyAdmin
On CISA KEVExploited in the wild
270
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 15High 30Medium 73Low 1
Watch
Add phpMyAdmin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2005-3301 | – | Oct 24 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-pl3 allow remote attackers to inject arbitrary web script or HTML via certain arguments to (1)… Affected: 2.6.4; 2.6.4_pl1; 2.6.4_pl2; 2.6.4_rc1 |
| CVE-2005-3300 | – | Oct 23 | The register_globals emulation layer in grab_globals.php for phpMyAdmin before 2.6.4-pl3 does not perform safety checks on values in the _FILES array for uploaded files, which… Affected: 2.6.4_pl3 |
| CVE-2005-3299 | – | Oct 23 | PHP file inclusion vulnerability in grab_globals.lib.php in phpMyAdmin 2.6.4 and 2.6.4-pl1 allows remote attackers to include local files via the $__redirect parameter, possibly… Affected: 2.6.4; 2.6.4_pl1 |
| CVE-2005-2869 | – | Sep 8 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the Username to… Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2005-1392 | – | May 3 | The SQL install script in phpMyAdmin 2.6.2 is created with world-readable permissions, which allows local users to obtain the initial database password by reading the script Affected: 2.6.2 |
| CVE-2005-0992 | – | May 2 | Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin before 2.6.2-rc1 allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2005-0653 | – | May 2 | phpMyAdmin 2.6.1 does not properly grant permissions on tables with an underscore in the name, which grants remote authenticated users more privileges than intended Affected: 2.6.1 |
| CVE-2005-0567 | – | May 2 | Multiple PHP remote file inclusion vulnerabilities in phpMyAdmin 2.6.1 allow remote attackers to execute arbitrary PHP code by modifying the (1) theme parameter to… Affected: 2.6.1 |
| CVE-2005-0544 | – | May 2 | phpMyAdmin 2.6.1 allows remote attackers to obtain the full path of the server via direct requests to (1) sqlvalidator.lib.php, (2) sqlparser.lib.php, (3) select_theme.lib.php,… Affected: 2.6.1 |
| CVE-2005-0459 | – | May 2 | phpMyAdmin 2.6.2-dev, and possibly earlier versions, allows remote attackers to determine the full path of the web root via a direct request to select_lang.lib.php, which reveals… Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +30 more |
| CVE-2004-1055 | – | Mar 1 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.6.0-pl2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PmaAbsoluteUri… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.4; 2.5.5; 2.5.5_pl1; +7 more |
| CVE-2005-0543 | – | Feb 24 | Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary HTML and web script via (1) the strServer, cfg[BgcolorOne], or… Affected: 2.6.0_pl2; 2.6.0_pl3; 2.6.1; 2.6.1_rc1 |
| CVE-2004-1148 | – | Jan 10 | phpMyAdmin before 2.6.1, when configured with UploadDir functionality, allows remote attackers to read arbitrary files via the sql_localfile parameter Affected: 2.4.0; 2.5.0; 2.5.1; 2.5.2; 2.5.4; 2.5.5; +9 more |
| CVE-2004-1147 | – | Jan 10 | phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary commands via shell metacharacters Affected: 2.4.0; 2.5.0; 2.5.1; 2.5.2; 2.5.4; 2.5.5; +9 more |
| CVE-2004-2632 | – | Dec 31 | phpMyAdmin 2.5.1 up to 2.5.7 allows remote attackers to modify configuration settings and gain unauthorized access to MySQL servers via modified $cfg['Servers'] variables Affected: 2.5.1; 2.5.2; 2.5.2_pl1; 2.5.3; 2.5.4; 2.5.5; +6 more |
| CVE-2004-2631 | – | Dec 31 | Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table… Affected: 2.5.1; 2.5.2; 2.5.2_pl1; 2.5.3; 2.5.4; 2.5.5; +6 more |
| CVE-2004-2630 | – | Dec 31 | The MIME transformation system (transformations/text_plain__external.inc.php) in phpMyAdmin 2.5.0 up to 2.6.0-pl1 allows remote attackers to execute arbitrary commands via shell… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.2_pl1; 2.5.3; 2.5.4; +9 more |
| CVE-2004-0129 | – | Mar 3 | Directory traversal vulnerability in export.php in phpMyAdmin 2.5.5 and earlier allows remote attackers to read arbitrary files via Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +23 more |
| CVE-2001-1060 | – | Jul 31 | phpMyAdmin 2.2.0rc3 and earlier allows remote attackers to execute arbitrary commands by inserting them into (1) the strCopyTableOK argument in tbl_copy.php, or (2) the… Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +7 more |
| CVE-2001-0478 | – | Jun 27 | Directory traversal vulnerability in phpMyAdmin 2.2.0 and earlier versions allows remote attackers to execute arbitrary code via a Affected: through 2.2.0 |