p PatchFirst

PatchFirst · Latest vulnerabilities

phpmyadmin/phpmyadmin vulnerabilities · Page 4

Vulnerabilities published for phpmyadmin/phpmyadmin in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 107

  1. CVE-2016-5733

    Medium · CVSS 6.1EPSS 2.18%Fix available

    CVE-2016-5733

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Update to 4.0.10.16
    • Update to 4.4.15.7
    • Update to 4.6.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2016-5732

    Medium · CVSS 6.1EPSS 1.64%Fix available

    CVE-2016-5732

    Multiple cross-site scripting (XSS) vulnerabilities in the partition-range implementation in templates/table/structure/display_partitions.phtml in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via crafted table parameters.

    phpmyadmin/phpmyadminPHP
    • Update to 4.6.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2016-5731

    Medium · CVSS 6.1EPSS 1.75%Fix available

    CVE-2016-5731

    Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Update to 4.0.10.16
    • Update to 4.4.15.7
    • Update to 4.6.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2016-5730

    Medium · CVSS 5.3EPSS 2.62%Fix available

    CVE-2016-5730

    phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Update to 4.0.10.16
    • Update to 4.4.15.7
    • Update to 4.6.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2016-5705

    Medium · CVSS 6.1EPSS 1.31%Fix available

    CVE-2016-5705

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) server-privileges certificate data fields on the user privileges page, (2) an "invalid JSON" error message in the error console, (3) a database name in the central columns implementation, (4) a group name, or (5) a search name in the bookmarks implementation.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Update to 4.4.15.7
    • Update to 4.6.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2016-5701

    Medium · CVSS 6.1EPSS 1.54%Fix available

    CVE-2016-5701

    setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to conduct BBCode injection attacks against HTTP sessions via a crafted URI.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Update to 4.0.10.16
    • Update to 4.4.15.7
    • Update to 4.6.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2016-2041

    High · CVSS 7.5EPSS 2.58%Fix available

    CVE-2016-2041

    libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Update to 4.0.10.13
    • Update to 4.4.15.3
    • Update to 4.5.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2016-2040

    Medium · CVSS 5.4EPSS 1.64%Fix available

    CVE-2016-2040

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) hostname in a Location header.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Update to 4.0.10.13
    • Update to 4.4.15.3
    • Update to 4.5.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. CVE-2016-1927

    High · CVSS 7.5EPSS 2.69%Fix available

    CVE-2016-1927

    The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Update to 4.0.10.13
    • Update to 4.4.15.3
    • Update to 4.5.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2015-6830

    Not ratedEPSS 10.43%Public exploitFix available

    CVE-2015-6830

    libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Update to 4.3.13.2
    • Update to 4.4.14.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2011-3592

    Not ratedEPSS 1.45%Fix available

    CVE-2011-3592

    Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a (1) database name, (2) table name, or (3) column name that is not properly handled after an inline-editing operation.

    phpmyadmin/phpmyadminPHP
    • Update to 3.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2011-3591

    Not ratedEPSS 1.45%Fix available

    CVE-2011-3591

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) js/functions.js and (2) js/tbl_structure.js.

    phpmyadmin/phpmyadminPHP
    • Update to 3.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. CVE-2014-6300

    Not ratedEPSS 1.86%Fix available

    CVE-2014-6300

    Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery (CSRF) attack to create a root account, via a crafted URL, related to js/ajax.js.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Update to 4.0.10.3
    • Update to 4.1.14.4
    • Update to 4.2.8.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2014-8326

    Not ratedEPSS 1.53%Fix available

    CVE-2014-8326

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name, related to the libraries/DatabaseInterface.class.php code for SQL debug output and the js/server_status_monitor.js code for the server monitor page.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Update to 4.0.10.5
    • Update to 4.1.14.6
    • Update to 4.2.10.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →