CVE-2025-24530 | Medium | 6.4 | 2025-01-23 | An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name… |
CVE-2025-24529 | Medium | 6.4 | 2025-01-23 | An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the Insert tab. |
CVE-2023-25727 | Medium | 5.4 | 2023-02-13 | In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface. |
CVE-2020-22452 | Critical | 9.8 | 2023-01-26 | SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation… |
CVE-2022-0813 | Medium | 5.3 | 2022-03-10 | PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the… |
CVE-2022-23808 | Medium | 6.1 | 2022-01-22 | An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML inj… |
CVE-2022-23807 | Medium | 4.3 | 2022-01-22 | An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their accou… |
CVE-2020-22278 | High | 8.8 | 2020-11-04 | phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because "the CSV file is accurately generated based on the dat… |
CVE-2020-26935 | Critical | 9.8 | 2020-10-10 | An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin pro… |
CVE-2020-26934 | Medium | 6.1 | 2020-10-10 | phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link. |
CVE-2020-11441 | Medium | 6.1 | 2020-03-31 | phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error pa… |
CVE-2020-10803 | Medium | 5.4 | 2020-03-22 | In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack t… |
CVE-2020-10802 | High | 8.0 | 2020-03-22 | In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when g… |
CVE-2020-10804 | High | 8.0 | 2020-03-22 | In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/… |
CVE-2020-5504 | High | 8.8 | 2020-01-09 | In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own… |
CVE-2019-19617 | Critical | 9.8 | 2019-12-06 | phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php. |
CVE-2019-18622 | Critical | 9.8 | 2019-11-22 | An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature. |
CVE-2019-12922 | Medium | 6.5 | 2019-09-13 | A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page. |
CVE-2019-12616 | Medium | 6.5 | 2019-06-05 | An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The a… |
CVE-2019-11768 | Critical | 9.8 | 2019-06-05 | An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL inject… |
CVE-2019-6799 | Medium | 5.9 | 2019-01-26 | An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, a… |
CVE-2019-6798 | Critical | 9.8 | 2019-01-26 | An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection atta… |
CVE-2018-19970 | Medium | 6.1 | 2018-12-11 | In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database… |
CVE-2018-19969 | High | 8.8 | 2018-12-11 | phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible t… |
CVE-2018-19968 | Medium | 6.5 | 2018-12-11 | An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have… |
CVE-2018-15605 | Medium | 6.1 | 2018-08-24 | An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate… |
CVE-2018-12613 | High | 8.8 | 2018-06-21 | An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerabilit… |
CVE-2018-12581 | Medium | 6.1 | 2018-06-21 | An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a craf… |
CVE-2017-18264 | Critical | 9.8 | 2018-05-01 | An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The restrictions caused by $cfg['S… |
CVE-2018-10188 | High | 8.8 | 2018-04-19 | phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libra… |
CVE-2018-7260 | Medium | 5.4 | 2018-02-21 | Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script… |
CVE-2017-1000499 | High | 8.8 | 2018-01-03 | phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform… |
CVE-2017-1000018 | High | 7.5 | 2017-07-17 | phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table name |
CVE-2017-1000017 | High | 8.8 | 2017-07-17 | phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL server |
CVE-2017-1000016 | High | 7.5 | 2017-07-17 | A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18. |
CVE-2017-1000015 | Medium | 6.1 | 2017-07-17 | phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parameters |
CVE-2017-1000014 | High | 7.5 | 2017-07-17 | phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality |
CVE-2017-1000013 | Medium | 6.1 | 2017-07-17 | phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness |
CVE-2016-6621 | High | 8.6 | 2017-01-31 | The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery… |
CVE-2016-9866 | Critical | 9.8 | 2016-12-11 | An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return U… |
CVE-2016-9865 | Critical | 9.8 | 2016-12-11 | An issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMA_safeUnserialize() fun… |
CVE-2016-9864 | High | 7.5 | 2016-12-11 | An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that wou… |
CVE-2016-9863 | High | 7.5 | 2016-12-11 | An issue was discovered in phpMyAdmin. With a very large request to table partitioning function, it is possible to invoke a Denial of Service (DoS) attack. All… |
CVE-2016-9862 | High | 7.5 | 2016-12-11 | An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are… |
CVE-2016-9861 | High | 7.5 | 2016-12-11 | An issue was discovered in phpMyAdmin. Due to the limitation in URL matching, it was possible to bypass the URL white-list protection. All 4.6.x versions (prio… |
CVE-2016-9860 | Medium | 5.9 | 2016-12-11 | An issue was discovered in phpMyAdmin. An unauthenticated user can execute a denial of service attack when phpMyAdmin is running with $cfg['AllowArbitraryServe… |
CVE-2016-9859 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in import feature. All 4.6… |
CVE-2016-9858 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in saved searches feature… |
CVE-2016-9857 | Medium | 6.1 | 2016-12-11 | An issue was discovered in phpMyAdmin. XSS is possible because of a weakness in a regular expression used in some JavaScript processing. All 4.6.x versions (pr… |
CVE-2016-9856 | Medium | 6.1 | 2016-12-11 | An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to av… |
CVE-2016-9855 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to displa… |
CVE-2016-9854 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to displa… |
CVE-2016-9853 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to displa… |
CVE-2016-9852 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to displa… |
CVE-2016-9851 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to bypass the logout timeout. All 4.6.x versions (prior to 4.6.5)… |
CVE-2016-9850 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. Username matching for the allow/deny rules may result in wrong matches and detection of the username in the rule due to… |
CVE-2016-9849 | Critical | 9.8 | 2016-12-11 | An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using N… |
CVE-2016-9848 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. phpinfo (phpinfo.php) shows PHP information including values of HttpOnly cookies. All 4.6.x versions (prior to 4.6.5), 4… |
CVE-2016-9847 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. When the user does not specify a blowfish_secret key for encrypting cookies, phpMyAdmin generates one at runtime. A vuln… |
CVE-2016-6633 | High | 8.1 | 2016-12-11 | An issue was discovered in phpMyAdmin. phpMyAdmin can be used to trigger a remote code execution attack against certain PHP installations that are running with… |
CVE-2016-6632 | Medium | 5.9 | 2016-12-11 | An issue was discovered in phpMyAdmin where, under certain conditions, phpMyAdmin may not delete temporary files during the import of ESRI files. All 4.6.x ver… |
CVE-2016-6631 | High | 7.5 | 2016-12-11 | An issue was discovered in phpMyAdmin. A user can execute a remote code execution attack against a server when phpMyAdmin is being run as a CGI application. Un… |
CVE-2016-6630 | Medium | 6.5 | 2016-12-11 | An issue was discovered in phpMyAdmin. An authenticated user can trigger a denial-of-service (DoS) attack by entering a very long password at the change passwo… |
CVE-2016-6629 | Critical | 9.8 | 2016-12-11 | An issue was discovered in phpMyAdmin involving the $cfg['ArbitraryServerRegexp'] configuration directive. An attacker could reuse certain cookie values in a w… |
CVE-2016-6628 | Medium | 6.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. An attacker may be able to trigger a user to download a specially crafted malicious SVG file. All 4.6.x versions (prior… |
CVE-2016-6627 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php. All 4.6.x versions (prior to 4.6.4), 4… |
CVE-2016-6626 | Medium | 5.4 | 2016-12-11 | An issue was discovered in phpMyAdmin. An attacker could redirect a user to a malicious web page. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to… |
CVE-2016-6625 | Medium | 4.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. An attacker can determine whether a user is logged in to phpMyAdmin. The user's session, username, and password are not… |
CVE-2016-6624 | Medium | 5.9 | 2016-12-11 | An issue was discovered in phpMyAdmin involving improper enforcement of the IP-based authentication rules. When phpMyAdmin is used with IPv6 in a proxy server… |
CVE-2016-6623 | Medium | 6.5 | 2016-12-11 | An issue was discovered in phpMyAdmin. An authorized user can cause a denial-of-service (DoS) attack on a server by passing large values to a loop. All 4.6.x v… |
CVE-2016-6622 | Medium | 5.9 | 2016-12-11 | An issue was discovered in phpMyAdmin. An unauthenticated user is able to execute a denial-of-service (DoS) attack by forcing persistent connections when phpMy… |
CVE-2016-6620 | Critical | 9.8 | 2016-12-11 | An issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize() function without verification that it's valid serialized data. The unserial… |
CVE-2016-6619 | High | 8.8 | 2016-12-11 | An issue was discovered in phpMyAdmin. In the user interface preference feature, a user can execute an SQL injection attack against the account of the control… |
CVE-2016-6618 | Medium | 6.5 | 2016-12-11 | An issue was discovered in phpMyAdmin. The transformation feature allows a user to trigger a denial-of-service (DoS) attack against the server. All 4.6.x versi… |
CVE-2016-6617 | High | 8.1 | 2016-12-11 | An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functio… |
CVE-2016-6616 | High | 7.5 | 2016-12-11 | An issue was discovered in phpMyAdmin. In the "User group" and "Designer" features, a user can execute an SQL injection attack against the account of the contr… |
CVE-2016-6615 | Medium | 6.1 | 2016-12-11 | XSS issues were discovered in phpMyAdmin. This affects navigation pane and database/table hiding feature (a specially-crafted database name can be used to trig… |
CVE-2016-6614 | Medium | 6.8 | 2016-12-11 | An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution… |
CVE-2016-6613 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. A user can specially craft a symlink on disk, to a file which phpMyAdmin is permitted to read but the user is not, which… |
CVE-2016-6612 | Medium | 6.5 | 2016-12-11 | An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database system. All 4.6.x v… |
CVE-2016-6611 | High | 8.1 | 2016-12-11 | An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functio… |
CVE-2016-6610 | Medium | 4.3 | 2016-12-11 | A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error in the export mechanism to discover the full path… |
CVE-2016-6609 | High | 8.8 | 2016-12-11 | An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6… |
CVE-2016-6608 | Medium | 6.1 | 2016-12-11 | XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially crafted database nam… |
CVE-2016-6607 | Medium | 6.1 | 2016-12-11 | XSS issues were discovered in phpMyAdmin. This affects Zoom search (specially crafted column content can be used to trigger an XSS attack); GIS editor (certain… |
CVE-2016-6606 | High | 8.1 | 2016-12-11 | An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an… |
CVE-2016-4412 | Medium | 4.4 | 2016-12-11 | An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malic… |
CVE-2016-5099 | Medium | 6.1 | 2016-07-05 | Cross-site scripting (XSS) vulnerability in phpMyAdmin 4.4.x before 4.4.15.6 and 4.6.x before 4.6.2 allows remote attackers to inject arbitrary web script or H… |
CVE-2016-5098 | Medium | 5.3 | 2016-07-05 | Directory traversal vulnerability in libraries/error_report.lib.php in phpMyAdmin before 4.6.2-prerelease allows remote attackers to determine the existence of… |
CVE-2016-5097 | Medium | 5.3 | 2016-07-05 | phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers t… |
CVE-2016-5739 | High | 7.5 | 2016-07-03 | The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Secu… |
CVE-2016-5734 | Critical | 9.8 | 2016-07-03 | phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka… |
CVE-2016-5733 | Medium | 6.1 | 2016-07-03 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers… |
CVE-2016-5732 | Medium | 6.1 | 2016-07-03 | Multiple cross-site scripting (XSS) vulnerabilities in the partition-range implementation in templates/table/structure/display_partitions.phtml in the table-st… |
CVE-2016-5731 | Medium | 6.1 | 2016-07-03 | Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remo… |
CVE-2016-5730 | Medium | 5.3 | 2016-07-03 | phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving… |
CVE-2016-5706 | High | 7.5 | 2016-07-03 | js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service… |
CVE-2016-5705 | Medium | 6.1 | 2016-07-03 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web s… |
CVE-2016-5704 | Medium | 6.1 | 2016-07-03 | Cross-site scripting (XSS) vulnerability in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or… |
CVE-2016-5703 | Critical | 9.8 | 2016-07-03 | SQL injection vulnerability in libraries/central_columns.lib.php in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to execute… |