# phpmyadmin/phpmyadmin (Packagist) vulnerabilities 107 known vulnerabilities (1 critical, 4 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/phpmyadmin/phpmyadmin ## Advisories (107) ### [CVE-2025-24530](https://cve.now/CVE-2025-24530): An issue was discovered in phpMyAdmin 5.x before 5.2.2. - Severity: Medium 6.4 - Published: Jan 23, 2025 - Affected: from 5.0.0, fixed in 5.2.2. ### [CVE-2023-25727](https://cve.now/CVE-2023-25727): In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the… - Severity: Medium 5.4 - Published: Feb 13, 2023 - Affected: from 4.3.0, fixed in 4.9.11; from 5.0, fixed in 5.2.1. ### [CVE-2020-22452](https://cve.now/CVE-2020-22452): SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the… - Severity: Critical 9.8 - Published: Jan 26, 2023 - Affected: from 5.0.0, fixed in 5.0.2. ### [CVE-2022-0813](https://cve.now/CVE-2022-0813): PhpMyAdmin exposure of sensitive information - Severity: Medium 5.3 - Published: Mar 9, 2022 - Affected: fixed in 5.1.3. ### [CVE-2022-23808](https://cve.now/CVE-2022-23808): An issue was discovered in phpMyAdmin 5.1 before 5.1.2. - Severity: Medium 6.1 - Published: Jan 22, 2022 - Affected: from 5.1.0, fixed in 5.1.2. ### [CVE-2022-23807](https://cve.now/CVE-2022-23807): An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. - Severity: Unrated - Published: Jan 22, 2022 - Affected: from 4.9.0, fixed in 4.9.8; from 5.1.0, fixed in 5.1.2. ### [CVE-2020-26934](https://cve.now/CVE-2020-26934): phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link. - Severity: Unrated - Published: Oct 10, 2020 - Affected: from 4.9.0, fixed in 4.9.6; from 5.0.0, fixed in 5.0.3. ### [CVE-2020-26935](https://cve.now/CVE-2020-26935): An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. - Severity: Unrated - Published: Oct 10, 2020 - Affected: from 4.9.0, fixed in 4.9.6; from 5.0.0, fixed in 5.0.3. ### [CVE-2020-10802](https://cve.now/CVE-2020-10802): In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not… - Severity: Unrated - Published: Mar 22, 2020 - Affected: from 4.9.0, fixed in 4.9.5; from 5.0.0, fixed in 5.0.2. ### [CVE-2020-10803](https://cve.now/CVE-2020-10803): In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to… - Severity: Unrated - Published: Mar 22, 2020 - Affected: from 3.4, fixed in 4.9.5; from 5.0.0, fixed in 5.0.2. ### [CVE-2020-10804](https://cve.now/CVE-2020-10804): In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in… - Severity: Unrated - Published: Mar 22, 2020 - Affected: from 4.9.0, fixed in 4.9.5; from 5.0.0, fixed in 5.0.2. ### [CVE-2020-5504](https://cve.now/CVE-2020-5504): In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. - Severity: Unrated - Published: Jan 9, 2020 - Affected: from 4.0.0, fixed in 4.9.4; from 5.0.0, fixed in 5.0.1. ### [CVE-2019-19617](https://cve.now/CVE-2019-19617): phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and… - Severity: Unrated - Published: Dec 6, 2019 - Affected: fixed in 4.9.2. ### [CVE-2019-18622](https://cve.now/CVE-2019-18622): An issue was discovered in phpMyAdmin before 4.9.2. - Severity: Unrated - Published: Nov 22, 2019 - Affected: fixed in 4.9.2. ### [CVE-2019-12922](https://cve.now/CVE-2019-12922): A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page. - Severity: Unrated - Published: Sep 13, 2019 - Affected: fixed in 4.9.1. ### [CVE-2019-12616](https://cve.now/CVE-2019-12616): An issue was discovered in phpMyAdmin before 4.9.0. - Severity: Unrated - Published: Jun 5, 2019 - Affected: fixed in 4.9.0. ### [CVE-2019-11768](https://cve.now/CVE-2019-11768): An issue was discovered in phpMyAdmin before 4.9.0.1. - Severity: Unrated - Published: Jun 5, 2019 - Affected: fixed in 4.9.0.1. ### [CVE-2019-6799](https://cve.now/CVE-2019-6799): An issue was discovered in phpMyAdmin before 4.8.5. - Severity: Unrated - Published: Jan 26, 2019 - Affected: from 4.8, fixed in 4.8.5. ### [CVE-2019-6798](https://cve.now/CVE-2019-6798): An issue was discovered in phpMyAdmin before 4.8.5. - Severity: Unrated - Published: Jan 26, 2019 - Affected: fixed in 4.8.5. ### [CVE-2018-19970](https://cve.now/CVE-2018-19970): In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user… - Severity: Unrated - Published: Dec 11, 2018 - Affected: from 4.0, fixed in 4.8.4. ### [CVE-2018-19969](https://cve.now/CVE-2018-19969): phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. - Severity: Unrated - Published: Dec 11, 2018 - Affected: from 4.8, fixed in 4.8.4; from 4.7, through 4.7.6. ### [CVE-2018-19968](https://cve.now/CVE-2018-19968): An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. - Severity: Unrated - Published: Dec 11, 2018 - Affected: fixed in 4.8.4. ### [CVE-2018-15605](https://cve.now/CVE-2018-15605): An issue was discovered in phpMyAdmin before 4.8.3. - Severity: Unrated - Published: Aug 24, 2018 - Affected: fixed in 4.8.3. ### [CVE-2018-12613](https://cve.now/CVE-2018-12613): An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the… - Severity: Unrated - Published: Jun 21, 2018 - Affected: from 4.8, fixed in 4.8.2. ### [CVE-2018-12581](https://cve.now/CVE-2018-12581): An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. - Severity: Unrated - Published: Jun 21, 2018 - Affected: fixed in 4.8.2. ### [CVE-2017-18264](https://cve.now/CVE-2017-18264): An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. - Severity: Unrated - Published: May 1, 2018 - Affected: from 4.0, fixed in 4.0.10.20; from 4.7.0-beta1, fixed in 4.7.0; from 4.4.0, through 4.4.15.10; from 4.6.0, through 4.6.6. ### [CVE-2018-10188](https://cve.now/CVE-2018-10188): phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db\_operations.js… - Severity: Unrated - Published: Apr 19, 2018 - Affected: from 4.8, fixed in 4.8.0.1. ### [CVE-2018-7260](https://cve.now/CVE-2018-7260): Cross-site scripting (XSS) vulnerability in db\_central\_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject… - Severity: Unrated - Published: Feb 21, 2018 - Affected: fixed in 4.7.8. ### [CVE-2017-1000499](https://cve.now/CVE-2017-1000499): phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. - Severity: Unrated - Published: Jan 3, 2018 - Affected: from 4.7, fixed in 4.7.7. ### [CVE-2017-1000018](https://cve.now/CVE-2017-1000018): phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table name - Severity: Unrated - Published: Jul 13, 2017 - Affected: from 4.6, fixed in 4.6.6; from 4.4, fixed in 4.4.15.10; from 4.0, fixed in 4.0.10.19. ### [CVE-2017-1000017](https://cve.now/CVE-2017-1000017): phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary… - Severity: Unrated - Published: Jul 13, 2017 - Affected: from 4.6, fixed in 4.6.6; from 4.4, fixed in 4.4.15.10; from 4.0, fixed in 4.0.10.19. ### [CVE-2017-1000016](https://cve.now/CVE-2017-1000016): A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. - Severity: Unrated - Published: Jul 13, 2017 - Affected: from 4.6, fixed in 4.6.6. ### [CVE-2017-1000015](https://cve.now/CVE-2017-1000015): phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parameters - Severity: Unrated - Published: Jul 13, 2017 - Affected: from 4.6.0, fixed in 4.6.6; from 4.4.0, fixed in 4.4.15.10; from 4.0.0, fixed in 4.0.10.19. ### [CVE-2017-1000014](https://cve.now/CVE-2017-1000014): phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality - Severity: Unrated - Published: Jul 13, 2017 - Affected: from 4.6, fixed in 4.6.6; from 4.4, fixed in 4.4.15.10; from 4.0, fixed in 4.0.10.19. ### [CVE-2017-1000013](https://cve.now/CVE-2017-1000013): phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness - Severity: Unrated - Published: Jul 13, 2017 - Affected: from 4.6, fixed in 4.6.6; from 4.4, fixed in 4.4.15.10; from 4.0, fixed in 4.0.10.19. ### [CVE-2016-6621](https://cve.now/CVE-2016-6621): The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct… - Severity: Unrated - Published: Jan 31, 2017 - Affected: from 4.6.0, fixed in 4.6.6; from 4.4.0, fixed in 4.4.15.10; fixed in 4.0.10.19. ### [CVE-2016-9866](https://cve.now/CVE-2016-9866): An issue was discovered in phpMyAdmin. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6.0, fixed in 4.6.5; from 4.4.0, fixed in 4.4.15.9; from 4.0.0, fixed in 4.0.10.18. ### [CVE-2016-9863](https://cve.now/CVE-2016-9863): An issue was discovered in phpMyAdmin. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6.0, fixed in 4.6.5. ### [CVE-2016-9861](https://cve.now/CVE-2016-9861): An issue was discovered in phpMyAdmin. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6, fixed in 4.6.5; from 4.4, fixed in 4.4.15.9; from 4.0, fixed in 4.0.10.18. ### [CVE-2016-9860](https://cve.now/CVE-2016-9860): An issue was discovered in phpMyAdmin. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6, fixed in 4.6.5; from 4.4, fixed in 4.4.15.9; from 4.0, fixed in 4.0.10.18. ### [CVE-2016-9857](https://cve.now/CVE-2016-9857): An issue was discovered in phpMyAdmin. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6, fixed in 4.6.5; from 4.4, fixed in 4.4.15.9; from 4.0, fixed in 4.0.10.18. ### [CVE-2016-9856](https://cve.now/CVE-2016-9856): An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6, fixed in 4.6.5; from 4.4, fixed in 4.4.15.9; from 4.0, fixed in 4.0.10.18. ### [CVE-2016-9853](https://cve.now/CVE-2016-9853): An issue was discovered in phpMyAdmin. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6.0, fixed in 4.6.5; from 4.4.0, fixed in 4.4.15.9. ### [CVE-2016-9851](https://cve.now/CVE-2016-9851): An issue was discovered in phpMyAdmin. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6, fixed in 4.6.5; from 4.4, fixed in 4.4.15.9. ### [CVE-2016-9847](https://cve.now/CVE-2016-9847): An issue was discovered in phpMyAdmin. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6, fixed in 4.6.5; from 4.4, fixed in 4.4.15.9; from 4.0, fixed in 4.0.10.18. ### [CVE-2016-6633](https://cve.now/CVE-2016-6633): An issue was discovered in phpMyAdmin. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6, fixed in 4.6.4; from 4.4, fixed in 4.4.15.8; from 4.0, fixed in 4.0.10.17. ### [CVE-2016-6632](https://cve.now/CVE-2016-6632): An issue was discovered in phpMyAdmin where, under certain conditions, phpMyAdmin may not delete temporary files during the import of ESRI… - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6, fixed in 4.6.4; from 4.4, fixed in 4.4.15.8; from 4.0, fixed in 4.0.10.17. ### [CVE-2016-6629](https://cve.now/CVE-2016-6629): An issue was discovered in phpMyAdmin involving the $cfg\['ArbitraryServerRegexp'\] configuration directive. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6, fixed in 4.6.4; from 4.4, fixed in 4.4.15.8; from 4.0, fixed in 4.0.10.17. ### [CVE-2016-6628](https://cve.now/CVE-2016-6628): An issue was discovered in phpMyAdmin. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6, fixed in 4.6.4; from 4.4, fixed in 4.4.15.8; from 4.0, fixed in 4.0.10.17. ### [CVE-2016-6625](https://cve.now/CVE-2016-6625): An issue was discovered in phpMyAdmin. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6, fixed in 4.6.4; from 4.4, fixed in 4.4.15.8; from 4.0, fixed in 4.0.10.17. ### [CVE-2016-6624](https://cve.now/CVE-2016-6624): An issue was discovered in phpMyAdmin involving improper enforcement of the IP-based authentication rules. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6, fixed in 4.6.4; from 4.4, fixed in 4.4.15.8; from 4.0, fixed in 4.0.10.17. ### [CVE-2016-6623](https://cve.now/CVE-2016-6623): An issue was discovered in phpMyAdmin. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6.0, fixed in 4.6.4; from 4.4.0, fixed in 4.4.15.8; from 4.0.0, fixed in 4.0.10.17. ### [CVE-2016-6622](https://cve.now/CVE-2016-6622): An issue was discovered in phpMyAdmin. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6, fixed in 4.6.4; from 4.4, fixed in 4.4.15.8; from 4.0, fixed in 4.0.10.17. ### [CVE-2016-6618](https://cve.now/CVE-2016-6618): An issue was discovered in phpMyAdmin. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6, fixed in 4.6.4; from 4.4, fixed in 4.4.15.8; from 4.0, fixed in 4.0.10.17. ### [CVE-2016-6613](https://cve.now/CVE-2016-6613): An issue was discovered in phpMyAdmin. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6, fixed in 4.6.4; from 4.4, fixed in 4.4.15.8; from 4.0, fixed in 4.0.10.17. ### [CVE-2016-6612](https://cve.now/CVE-2016-6612): An issue was discovered in phpMyAdmin. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6, fixed in 4.6.4; from 4.4, fixed in 4.4.15.8; from 4.0, fixed in 4.0.10.17. ### [CVE-2016-6609](https://cve.now/CVE-2016-6609): An issue was discovered in phpMyAdmin. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6, fixed in 4.6.4; from 4.4, fixed in 4.4.15.8; from 4.0, fixed in 4.0.10.17. ### [CVE-2016-6608](https://cve.now/CVE-2016-6608): XSS issues were discovered in phpMyAdmin. - Severity: Unrated - Published: Dec 11, 2016 - Affected: from 4.6, fixed in 4.6.4. ### [CVE-2016-5739](https://cve.now/CVE-2016-5739): The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the… - Severity: Unrated - Published: Jul 3, 2016 - Affected: from 4.0.10.0, fixed in 4.0.10.16; from 4.4.15.0, fixed in 4.4.15.7; from 4.6.0, fixed in 4.6.3. ### [CVE-2016-5734](https://cve.now/CVE-2016-5734): phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the… - Severity: Unrated - Published: Jul 3, 2016 - Affected: from 4.0.10.0, fixed in 4.0.10.16; from 4.4.15.0, fixed in 4.4.15.7; from 4.6.0, fixed in 4.6.3. ### [CVE-2016-5733](https://cve.now/CVE-2016-5733): Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3… - Severity: Unrated - Published: Jul 3, 2016 - Affected: from 4.0.10.0, fixed in 4.0.10.16; from 4.4.15.0, fixed in 4.4.15.7; from 4.6.0, fixed in 4.6.3. ### [CVE-2016-5732](https://cve.now/CVE-2016-5732): Multiple cross-site scripting (XSS) vulnerabilities in the partition-range implementation in… - Severity: Unrated - Published: Jul 3, 2016 - Affected: from 4.6.0, fixed in 4.6.3. ### [CVE-2016-5731](https://cve.now/CVE-2016-5731): Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x… - Severity: Unrated - Published: Jul 3, 2016 - Affected: from 4.0, fixed in 4.0.10.16; from 4.4, fixed in 4.4.15.7; from 4.6, fixed in 4.6.3. ### [CVE-2016-5730](https://cve.now/CVE-2016-5730): phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information… - Severity: Unrated - Published: Jul 3, 2016 - Affected: from 4.0, fixed in 4.0.10.16; from 4.4, fixed in 4.4.15.7; from 4.6, fixed in 4.6.3. ### [CVE-2016-5706](https://cve.now/CVE-2016-5706): js/get\_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause… - Severity: Unrated - Published: Jul 3, 2016 - Affected: from 4.0, fixed in 4.0.10.16; from 4.4, fixed in 4.4.15.7; from 4.6, fixed in 4.6.3. ### [CVE-2016-5705](https://cve.now/CVE-2016-5705): Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to… - Severity: Unrated - Published: Jul 3, 2016 - Affected: from 4.4.0, fixed in 4.4.15.7; from 4.6.0, fixed in 4.6.3. ### [CVE-2016-5704](https://cve.now/CVE-2016-5704): Cross-site scripting (XSS) vulnerability in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allows remote attackers to inject… - Severity: Unrated - Published: Jul 3, 2016 - Affected: from 4.6.0, fixed in 4.6.3. ### [CVE-2016-5702](https://cve.now/CVE-2016-5702): phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP\_SELF value, allows remote attackers to conduct cookie-attribute injection… - Severity: Unrated - Published: Jul 3, 2016 - Affected: from 4.6.0, fixed in 4.6.3. ### [CVE-2016-5701](https://cve.now/CVE-2016-5701): setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote… - Severity: Unrated - Published: Jul 3, 2016 - Affected: from 4.0.10.0, fixed in 4.0.10.16; from 4.4.15.0, fixed in 4.4.15.7; from 4.6.0, fixed in 4.6.3. ### [CVE-2016-2562](https://cve.now/CVE-2016-2562): The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from… - Severity: Unrated - Published: Mar 1, 2016 - Affected: from 4.5, fixed in 4.5.5.1. ### [CVE-2016-2559](https://cve.now/CVE-2016-2559): Cross-site scripting (XSS) vulnerability in the format function in libraries/sql-parser/src/Utils/Error.php in the SQL parser in… - Severity: Unrated - Published: Mar 1, 2016 - Affected: from 4.5, fixed in 4.5.5.1. ### [CVE-2016-2041](https://cve.now/CVE-2016-2041): libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time… - Severity: Unrated - Published: Feb 20, 2016 - Affected: from 4.0, fixed in 4.0.10.13; from 4.4, fixed in 4.4.15.3; from 4.5, fixed in 4.5.4. ### [CVE-2016-2040](https://cve.now/CVE-2016-2040): Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4… - Severity: Unrated - Published: Feb 20, 2016 - Affected: from 4.0, fixed in 4.0.10.13; from 4.4, fixed in 4.4.15.3; from 4.5, fixed in 4.5.4. ### [CVE-2016-1927](https://cve.now/CVE-2016-1927): The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies… - Severity: Unrated - Published: Feb 20, 2016 - Affected: from 4.0.0, fixed in 4.0.10.13; from 4.4.0, fixed in 4.4.15.3; from 4.5.0, fixed in 4.5.4. ### [CVE-2015-7873](https://cve.now/CVE-2015-7873): The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via… - Severity: Unrated - Published: Oct 28, 2015 - Affected: from 4.4.0, fixed in 4.4.15.1; from 4.5.0, fixed in 4.5.1. ### [CVE-2015-6830](https://cve.now/CVE-2015-6830): libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote… - Severity: Unrated - Published: Sep 14, 2015 - Affected: from 4.3.0, fixed in 4.3.13.2; from 4.4.0, fixed in 4.4.14.1. ### [CVE-2011-3592](https://cve.now/CVE-2011-3592): Multiple cross-site scripting (XSS) vulnerabilities in the PMA\_unInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5… - Severity: Unrated - Published: Dec 26, 2014 - Affected: from 3.4.0, fixed in 3.4.5. ### [CVE-2011-3591](https://cve.now/CVE-2011-3591): Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary… - Severity: Unrated - Published: Dec 26, 2014 - Affected: from 3.4.0, fixed in 3.4.5. ### [CVE-2014-6300](https://cve.now/CVE-2014-6300): Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4… - Severity: Unrated - Published: Nov 8, 2014 - Affected: from 4.0.0, fixed in 4.0.10.3; from 4.1.0, fixed in 4.1.14.4; from 4.2.0, fixed in 4.2.8.1. ### [CVE-2014-8326](https://cve.now/CVE-2014-8326): Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1… - Severity: Unrated - Published: Nov 5, 2014 - Affected: from 4.0.0, fixed in 4.0.10.5; from 4.1.0, fixed in 4.1.14.6; from 4.2.0, fixed in 4.2.10.1. ### [CVE-2014-7217](https://cve.now/CVE-2014-7217): Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1… - Severity: Unrated - Published: Oct 3, 2014 - Affected: from 4.0.0, fixed in 4.0.10.4; from 4.1.0, fixed in 4.1.14.5; from 4.2.0, fixed in 4.2.9.1. ### [CVE-2014-5274](https://cve.now/CVE-2014-5274): Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows… - Severity: Unrated - Published: Aug 22, 2014 - Affected: from 4.1.0, fixed in 4.1.14.3; from 4.2.0, fixed in 4.2.7.1. ### [CVE-2014-4986](https://cve.now/CVE-2014-4986): Multiple cross-site scripting (XSS) vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and… - Severity: Unrated - Published: Jul 20, 2014 - Affected: from 4.0.0, fixed in 4.0.10.1; from 4.1.0, fixed in 4.1.14.2; from 4.2.0, fixed in 4.2.6. ### [CVE-2013-5002](https://cve.now/CVE-2013-5002): Cross-site scripting (XSS) vulnerability in libraries/schema/Export\_Relation\_Schema.class.php in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x… - Severity: Unrated - Published: Jul 30, 2013 - Affected: from 3.5, fixed in 3.5.8.2; from 4.0, fixed in 4.0.4.2. ### [CVE-2013-4997](https://cve.now/CVE-2013-4997): Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web… - Severity: Unrated - Published: Jul 30, 2013 - Affected: from 3.5, fixed in 3.5.8.2. ### [CVE-2013-4729](https://cve.now/CVE-2013-4729): import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows… - Severity: Unrated - Published: Jul 4, 2013 - Affected: from 4.0, fixed in 4.0.4.1. ### [CVE-2013-3239](https://cve.now/CVE-2013-3239): phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to… - Severity: Unrated - Published: Apr 26, 2013 - Affected: from 3.5.0, fixed in 3.5.8.1. ### [CVE-2012-5368](https://cve.now/CVE-2012-5368): phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows… - Severity: Unrated - Published: Oct 25, 2012 - Affected: from 3.5, fixed in 3.5.3. ### [CVE-2012-5339](https://cve.now/CVE-2012-5339): Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary… - Severity: Unrated - Published: Oct 25, 2012 - Affected: from 3.5, fixed in 3.5.3. ### [CVE-2012-4579](https://cve.now/CVE-2012-4579): Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.2.2 allow remote authenticated users to inject… - Severity: Unrated - Published: Aug 21, 2012 - Affected: from 3.5, fixed in 3.5.2.2. ### [CVE-2012-4345](https://cve.now/CVE-2012-4345): Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before… - Severity: Unrated - Published: Aug 21, 2012 - Affected: from 3.4, fixed in 3.4.11.1; from 3.5, fixed in 3.5.2.2. ### [CVE-2011-1941](https://cve.now/CVE-2011-1941): Open redirect vulnerability in the redirector feature in phpMyAdmin 3.4.x before 3.4.1 allows remote attackers to redirect users to… - Severity: Unrated - Published: Jan 26, 2012 - Affected: from 3.4.0, fixed in 3.4.1. ### [CVE-2011-1940](https://cve.now/CVE-2011-1940): Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.3.x before 3.3.10.1 and 3.4.x before 3.4.1 allow remote attackers to… - Severity: Unrated - Published: Jan 26, 2012 - Affected: from 3.3.0, fixed in 3.3.10.1; from 3.4.0, fixed in 3.4.1. ### [CVE-2011-4782](https://cve.now/CVE-2011-4782): Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9… - Severity: Unrated - Published: Dec 22, 2011 - Affected: from 3.4.0, fixed in 3.4.9. ### [CVE-2011-4634](https://cve.now/CVE-2011-4634): Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.8 allow remote attackers to inject arbitrary web script… - Severity: Unrated - Published: Dec 22, 2011 - Affected: from 3.4.0, fixed in 3.4.8. ### [CVE-2011-4107](https://cve.now/CVE-2011-4107): The simplexml\_load\_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x… - Severity: Unrated - Published: Nov 17, 2011 - Affected: from 3.4.0, fixed in 3.4.7.1; from 3.3.0, fixed in 3.3.10.5. ### [CVE-2011-2718](https://cve.now/CVE-2011-2718): Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote… - Severity: Unrated - Published: Aug 1, 2011 - Affected: from 3.4, fixed in 3.4.3.2. ### [CVE-2011-2508](https://cve.now/CVE-2011-2508): Directory traversal vulnerability in libraries/display\_tbl.lib.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1, when a… - Severity: Unrated - Published: Jul 14, 2011 - Affected: from 3.3.0, fixed in 3.3.10.2; from 3.4.0, fixed in 3.4.3.1. ### [CVE-2011-2506](https://cve.now/CVE-2011-2506): setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of… - Severity: Unrated - Published: Jul 14, 2011 - Affected: from 3.0, fixed in 3.3.10.2; from 3.4, fixed in 3.4.3.1. ### [CVE-2011-2505](https://cve.now/CVE-2011-2505): libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1… - Severity: Unrated - Published: Jul 14, 2011 - Affected: from 3.0, fixed in 3.3.10.2; from 3.4, fixed in 3.4.3.1. ### [CVE-2011-0986](https://cve.now/CVE-2011-0986): phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and… - Severity: Unrated - Published: Feb 14, 2011 - Affected: from 2.11.0, fixed in 2.11.11.2; from 3.3.0, fixed in 3.3.9.1. ### [CVE-2010-4481](https://cve.now/CVE-2010-4481): phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to… - Severity: Unrated - Published: Dec 17, 2010 - Affected: fixed in 3.4.0-beta1. ### [CVE-2010-2958](https://cve.now/CVE-2010-2958): Cross-site scripting (XSS) vulnerability in libraries/Error.class.php in phpMyAdmin 3.x before 3.3.6 allows remote attackers to inject… - Severity: Unrated - Published: Sep 8, 2010 - Affected: from 3.0.0, fixed in 3.3.6. ### [CVE-2008-7252](https://cve.now/CVE-2008-7252): libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 uses predictable filenames for temporary files, which has unknown impact and… - Severity: Unrated - Published: Jan 19, 2010 - Affected: from 2.11.0, fixed in 2.11.10. ### [CVE-2009-3696](https://cve.now/CVE-2009-3696): Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to inject… - Severity: Unrated - Published: Oct 16, 2009 - Affected: from 2.11.0, fixed in 2.11.9.6; from 3.0.0, fixed in 3.2.2.1. ### [CVE-2009-1149](https://cve.now/CVE-2009-1149): CRLF injection vulnerability in bs\_disp\_as\_mime\_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote… - Severity: Unrated - Published: Mar 26, 2009 - Affected: fixed in 3.1.3.1. ### [CVE-2005-3621](https://cve.now/CVE-2005-3621): CRLF injection vulnerability in phpMyAdmin before 2.6.4-pl4 allows remote attackers to conduct HTTP response splitting attacks via… - Severity: Unrated - Published: Nov 16, 2005 - Affected: fixed in 2.6.4-pl4. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/phpmyadmin/phpmyadmin Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.