phpmyadmin vulnerabilities

Recent CVEs affecting phpmyadmin products. 275 tracked.

phpmyadmin has 275 tracked vulnerabilities, 15 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 68. Most recent: 2026-10-30. Highest priority: CVE-2009-1151 (score 100/100).

• CVE-2026-119426 HIGH 7.5 UPGRADE phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to e
• CVE-2026-119427 MEDIUM 4.2 UPGRADE phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authent
• CVE-2026-119428 LOW 3.7 UPGRADE phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated atta
• CVE-2026-119429 MEDIUM 4.3 UPGRADE phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attacker
• CVE-2026-119561 MEDIUM 6.8 UPGRADE phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAsse
• CVE-2026-119562 MEDIUM 4.2 UPGRADE phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL
• CVE-2026-119563 MEDIUM 5.4 UPGRADE phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with
• CVE-2020-22452 CRITICAL 9.8 UPGRADE SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5
• CVE-2023-25727 MEDIUM 5.4 UPGRADE In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted
• CVE-2022-23808 MEDIUM 6.1 UPGRADE An issue was discovered in phpMyAdmin 5.1 before 5.1.2
• CVE-2022-23807 MEDIUM 4.3 UPGRADE An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2
• CVE-2022-0813 MEDIUM 5.3 UPGRADE PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating inval
• CVE-2020-5504 HIGH 8.8 UPGRADE MITIGATE In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page
• CVE-2020-26935 CRITICAL 9.8 UPGRADE DOWNGRADE An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3
• CVE-2020-26934 MEDIUM 6.1 UPGRADE DOWNGRADE phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.
• CVE-2020-22278 HIGH 8.8 UPGRADE phpMyAdmin through 5.0.2 allows CSV injection via Export Section
• CVE-2020-11441 MEDIUM 6.1 DOWNGRADE phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields caus
• CVE-2020-10804 HIGH 8.0 UPGRADE MITIGATE In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of t
• CVE-2020-10803 MEDIUM 5.4 UPGRADE MITIGATE In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malici
• CVE-2020-10802 HIGH 8.0 UPGRADE MITIGATE In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where c
• CVE-2019-6799 MEDIUM 5.9 UPGRADE MITIGATE An issue was discovered in phpMyAdmin before 4.8.5
• CVE-2019-6798 CRITICAL 9.8 UPGRADE An issue was discovered in phpMyAdmin before 4.8.5
• CVE-2019-19617 CRITICAL 9.8 UPGRADE MITIGATE phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevis
• CVE-2019-18622 CRITICAL 9.8 UPGRADE DOWNGRADE An issue was discovered in phpMyAdmin before 4.9.2
• CVE-2019-12922 MEDIUM 6.5 UPGRADE MITIGATE A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.
• CVE-2019-12616 MEDIUM 6.5 UPGRADE An issue was discovered in phpMyAdmin before 4.9.0
• CVE-2019-11768 CRITICAL 9.8 UPGRADE An issue was discovered in phpMyAdmin before 4.9.0.1
• CVE-2018-7260 MEDIUM 5.4 UPGRADE Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote au
• CVE-2018-19970 MEDIUM 6.1 UPGRADE MITIGATE In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliv
• CVE-2018-19969 HIGH 8.8 UPGRADE phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws
• CVE-2018-19968 MEDIUM 6.5 UPGRADE MITIGATE An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in th
• CVE-2018-15605 MEDIUM 6.1 UPGRADE An issue was discovered in phpMyAdmin before 4.8.3
• CVE-2018-12613 HIGH 8.8 UPGRADE An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potential
• CVE-2018-12581 MEDIUM 6.1 UPGRADE An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2
• CVE-2018-10188 HIGH 8.8 DOWNGRADE phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to
• CVE-2017-18264 CRITICAL 9.8 UPGRADE MITIGATE An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.
• CVE-2017-1000499 HIGH 8.8 UPGRADE phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness
• CVE-2017-1000018 HIGH 7.5 UPGRADE phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially cr
• CVE-2017-1000017 HIGH 8.8 UPGRADE phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to
• CVE-2017-1000016 HIGH 7.5 DOWNGRADE A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies
• CVE-2017-1000015 MEDIUM 6.1 DOWNGRADE phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parameters
• CVE-2017-1000014 HIGH 7.5 DOWNGRADE phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality
• CVE-2017-1000013 MEDIUM 6.1 DOWNGRADE phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness
• CVE-2016-9866 CRITICAL 9.8 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-9865 CRITICAL 9.8 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-9864 HIGH 7.5 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-9863 HIGH 7.5 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-9862 HIGH 7.5 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-9861 HIGH 7.5 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-9860 MEDIUM 5.9 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-9859 MEDIUM 5.3 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-9858 MEDIUM 5.3 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-9857 MEDIUM 6.1 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-9856 MEDIUM 6.1 DOWNGRADE An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10
• CVE-2016-9855 MEDIUM 5.3 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-9854 MEDIUM 5.3 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-9853 MEDIUM 5.3 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-9852 MEDIUM 5.3 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-9851 MEDIUM 5.3 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-9850 MEDIUM 5.3 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-9849 CRITICAL 9.8 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-9848 MEDIUM 5.3 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-9847 MEDIUM 5.3 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6633 HIGH 8.1 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6632 MEDIUM 5.9 DOWNGRADE An issue was discovered in phpMyAdmin where, under certain conditions, phpMyAdmin may not delete temporary fil
• CVE-2016-6631 HIGH 7.5 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6630 MEDIUM 6.5 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6629 CRITICAL 9.8 DOWNGRADE An issue was discovered in phpMyAdmin involving the $cfg['ArbitraryServerRegexp'] configuration directive
• CVE-2016-6628 MEDIUM 6.3 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6627 MEDIUM 5.3 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6626 MEDIUM 5.4 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6625 MEDIUM 4.3 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6624 MEDIUM 5.9 DOWNGRADE An issue was discovered in phpMyAdmin involving improper enforcement of the IP-based authentication rules
• CVE-2016-6623 MEDIUM 6.5 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6622 MEDIUM 5.9 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6621 HIGH 8.6 UPGRADE The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote
• CVE-2016-6620 CRITICAL 9.8 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6619 HIGH 8.8 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6618 MEDIUM 6.5 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6617 HIGH 8.1 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6616 HIGH 7.5 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6615 MEDIUM 6.1 DOWNGRADE XSS issues were discovered in phpMyAdmin
• CVE-2016-6614 MEDIUM 6.8 DOWNGRADE An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and U
• CVE-2016-6613 MEDIUM 5.3 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6612 MEDIUM 6.5 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6611 HIGH 8.1 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6610 MEDIUM 4.3 DOWNGRADE A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error
• CVE-2016-6609 HIGH 8.8 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-6608 MEDIUM 6.1 DOWNGRADE XSS issues were discovered in phpMyAdmin
• CVE-2016-6607 MEDIUM 6.1 DOWNGRADE XSS issues were discovered in phpMyAdmin
• CVE-2016-6606 HIGH 8.1 DOWNGRADE An issue was discovered in cookie encryption in phpMyAdmin
• CVE-2016-5739 HIGH 7.5 MITIGATE MITIGATE The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x befor
• CVE-2016-5734 CRITICAL 9.8 DOWNGRADE phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose deli
• CVE-2016-5733 MEDIUM 6.1 DOWNGRADE MITIGATE Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.
• CVE-2016-5732 MEDIUM 6.1 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in the partition-range implementation in templates/table/s
• CVE-2016-5731 MEDIUM 6.1 DOWNGRADE MITIGATE Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x be
• CVE-2016-5730 MEDIUM 5.3 DOWNGRADE MITIGATE phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to ob
• CVE-2016-5706 HIGH 7.5 DOWNGRADE MITIGATE js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allo
• CVE-2016-5705 MEDIUM 6.1 MITIGATE MITIGATE Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3
• CVE-2016-5704 MEDIUM 6.1 DOWNGRADE Cross-site scripting (XSS) vulnerability in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allows r
• CVE-2016-5703 CRITICAL 9.8 MITIGATE MITIGATE SQL injection vulnerability in libraries/central_columns.lib.php in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x
• CVE-2016-5702 LOW 3.7 DOWNGRADE phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct
• CVE-2016-5701 MEDIUM 6.1 DOWNGRADE MITIGATE setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before
• CVE-2016-5099 MEDIUM 6.1 DOWNGRADE MITIGATE Cross-site scripting (XSS) vulnerability in phpMyAdmin 4.4.x before 4.4.15.6 and 4.6.x before 4.6.2 allows rem
• CVE-2016-5098 MEDIUM 5.3 DOWNGRADE MITIGATE Directory traversal vulnerability in libraries/error_report.lib.php in phpMyAdmin before 4.6.2-prerelease allo
• CVE-2016-5097 MEDIUM 5.3 MITIGATE UPGRADE phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before ext
• CVE-2016-4412 MEDIUM 4.4 DOWNGRADE An issue was discovered in phpMyAdmin
• CVE-2016-2562 MEDIUM 6.8 DOWNGRADE The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509
• CVE-2016-2561 MEDIUM 5.4 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.5 and 4.5.x before 4.5.5
• CVE-2016-2560 MEDIUM 6.1 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.15, 4.4.x before 4.4.15.
• CVE-2016-2559 MEDIUM 5.4 DOWNGRADE Cross-site scripting (XSS) vulnerability in the format function in libraries/sql-parser/src/Utils/Error.php in
• CVE-2016-2045 MEDIUM 5.4 DOWNGRADE MITIGATE Cross-site scripting (XSS) vulnerability in the SQL editor in phpMyAdmin 4.5.x before 4.5.4 allows remote auth
• CVE-2016-2044 MEDIUM 5.3 MITIGATE DOWNGRADE libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers t
• CVE-2016-2043 MEDIUM 5.4 MITIGATE MITIGATE Cross-site scripting (XSS) vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.
• CVE-2016-2042 MEDIUM 5.3 MITIGATE MITIGATE phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive informatio
• CVE-2016-2041 HIGH 7.5 MITIGATE DOWNGRADE libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 d
• CVE-2016-2040 MEDIUM 5.4 MITIGATE MITIGATE Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.
• CVE-2016-2039 MEDIUM 5.3 MITIGATE MITIGATE libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4
• CVE-2016-2038 MEDIUM 5.3 DOWNGRADE MITIGATE phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to ob
• CVE-2016-1927 HIGH 7.5 DOWNGRADE The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, a
• CVE-2015-8669 MEDIUM 5.3 DOWNGRADE libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x befor
• CVE-2015-7873 MEDIUM 5.0 DOWNGRADE The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote at
• CVE-2015-6830 MEDIUM 5.0 DOWNGRADE libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4
• CVE-2015-3903 MEDIUM 4.3 DOWNGRADE libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1,
• CVE-2015-3902 MEDIUM 6.8 DOWNGRADE Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x before 4.0
• CVE-2015-2206 MEDIUM 5.0 MITIGATE DOWNGRADE libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3
• CVE-2014-9219 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.
• CVE-2014-9218 MEDIUM 5.0 DOWNGRADE libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1
• CVE-2014-8961 MEDIUM 4.0 DOWNGRADE MITIGATE Directory traversal vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdm
• CVE-2014-8960 LOW 3.5 DOWNGRADE Cross-site scripting (XSS) vulnerability in libraries/error_report.lib.php in the error-reporting feature in p
• CVE-2014-8959 MEDIUM 6.5 MITIGATE DOWNGRADE Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in phpMyAdmin 4.0.x
• CVE-2014-8958 MEDIUM 4.3 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7
• CVE-2014-8326 LOW 3.5 DOWNGRADE MITIGATE Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6
• CVE-2014-7217 LOW 3.5 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5
• CVE-2014-6300 MEDIUM 4.3 MITIGATE DOWNGRADE Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10
• CVE-2014-5274 LOW 3.5 DOWNGRADE MITIGATE Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4
• CVE-2014-5273 LOW 3.5 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3
• CVE-2014-4987 MEDIUM 4.0 MITIGATE DOWNGRADE server_user_groups.php in phpMyAdmin 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6 allows remote authenticated
• CVE-2014-4986 LOW 3.5 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1, 4.
• CVE-2014-4955 LOW 3.5 DOWNGRADE Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function in libraries/rte/rte_list.lib.p
• CVE-2014-4954 LOW 3.5 DOWNGRADE Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.
• CVE-2014-4349 LOW 3.5 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4
• CVE-2014-4348 LOW 3.5 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.2.x before 4.2.4 allow remote authenticate
• CVE-2014-1879 LOW 3.5 UPGRADE Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated
• CVE-2013-5029 MEDIUM 4.3 MITIGATE DOWNGRADE phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanis
• CVE-2013-5003 MEDIUM 6.5 DOWNGRADE Multiple SQL injection vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remot
• CVE-2013-5002 LOW 3.5 DOWNGRADE Cross-site scripting (XSS) vulnerability in libraries/schema/Export_Relation_Schema.class.php in phpMyAdmin 3.
• CVE-2013-5001 LOW 3.5 DOWNGRADE Cross-site scripting (XSS) vulnerability in libraries/plugins/transformations/abstract/TextLinkTransformations
• CVE-2013-5000 MEDIUM 5.0 DOWNGRADE phpMyAdmin 3.5.x before 3.5.8.2 allows remote attackers to obtain sensitive information via an invalid request
• CVE-2013-4999 MEDIUM 5.0 DOWNGRADE phpMyAdmin 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request

FAQ

How do I fix phpmyadmin vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is phpmyadmin being exploited right now?

Yes: 1 phpmyadmin CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which phpmyadmin CVE should I patch first?

CVE-2009-1151 currently ranks highest (100/100): phpMyAdmin Remote Code Execution Vulnerability.

Products

• phpmyadmin

RSS feed for phpmyadmin · ← Back to latest CVEs