CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2009-1149
https://notcve.org/view.php?id=CVE-2009-1149
26 Mar 2009 — CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the (1) c_type and possibly (2) file_type parameters. Vulnerabilidad de inyección CRLF en el archivo bs_disp_as_mime_type.php en la característica BLOB streaming en phpMyAdmin anteriores a v3.1.3.1 permite a los atacantes remotos inyectar arbitrariamente cabeceras HTTP y llevar a cabo ataqu... • http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 41EXPL: 0CVE-2009-1150
https://notcve.org/view.php?id=CVE-2009-1150
26 Mar 2009 — Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allow remote attackers to inject arbitrary web script or HTML via the pma_db_filename_template cookie. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados - XSS - en la página de exportación (display_export.lib.php) en phpMyAdmin v2.11.x anteriores a v2.11.9.5 y v3.x anteriores a v3.1.3.1, permite a los atacantes remotos ... • http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 86%CPEs: 41EXPL: 6CVE-2009-1151 – phpMyAdmin Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2009-1151
26 Mar 2009 — Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action. Vulnerabilidad de inyección de código estático en el archivo setup.php en phpMyAdmin v2.11.x anteriores a v2.11.9.5 y v3.x anteriores a v3.1.3.1 que permite a los atacantes remotos inyectar código PHP arbitrariamente en el archivo de configuración a través de la acción guardar. Setup script used to gen... • https://www.exploit-db.com/exploits/8921 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 27EXPL: 1CVE-2008-5621 – phpMyAdmin 3.1.0 - Cross-Site Request Forgery / SQL Injection
https://notcve.org/view.php?id=CVE-2008-5621
17 Dec 2008 — Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the administrator via a link or IMG tag to tbl_structure.php with a modified table parameter. NOTE: other unspecified pages are also reachable, but they have the same root cause. NOTE: this can be leveraged to conduct SQL injection attacks and execute arbitrary code. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en phpM... • https://www.exploit-db.com/exploits/7382 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 1%CPEs: 139EXPL: 1CVE-2008-4326
https://notcve.org/view.php?id=CVE-2008-4326
30 Sep 2008 — The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via a NUL byte inside a "
CVSS: 8.8EPSS: 8%CPEs: 52EXPL: 3CVE-2008-4096 – phpMyAdmin 3.2 - 'server_databases.php' Remote Command Execution
https://notcve.org/view.php?id=CVE-2008-4096
17 Sep 2008 — libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by parameter containing PHP sequences, which are processed by create_function. libraries/database_interface.lib.php en phpMyAdmin anterior a 2.11.9.1, permite a usuarios autenticados en remoto ejecutar código de su elección a través de una solicitud a server_databases.php con un parámetro sort_by que contenga secuencias PHP que son p... • https://www.exploit-db.com/exploits/32383 • CWE-20: Improper Input Validation •
CVSS: 6.4EPSS: 1%CPEs: 42EXPL: 1CVE-2008-3456
https://notcve.org/view.php?id=CVE-2008-3456
04 Aug 2008 — phpMyAdmin before 2.11.8 does not sufficiently prevent its pages from using frames that point to pages in other domains, which makes it easier for remote attackers to conduct spoofing or phishing activities via a cross-site framing attack. phpMyAdmin anterior a 2.11.8 no previene adecuadamente sus páginas con marcos (frames) que apuntan a otros dominios, los que puede facilitar a atacantes remotos llevar a cabo actividades de phishing o suplantación a través de un ataje de marcos en sitios cruzados. • http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 6.1EPSS: 0%CPEs: 42EXPL: 1CVE-2008-3457
https://notcve.org/view.php?id=CVE-2008-3457
04 Aug 2008 — Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en setup.php de phpMyAdmin versiones anteriores a 2.11.8 permite a atacantes remotos asistidos por el usuario inyectar web script ... • http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 134EXPL: 1CVE-2008-3197
https://notcve.org/view.php?id=CVE-2008-3197
16 Jul 2008 — Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1 allows remote attackers to perform unauthorized actions via a link or IMG tag to (1) the db parameter in the "Creating a Database" functionality (db_create.php), and (2) the convcharset and collation_connection parameters related to an unspecified program that modifies the connection character set. Una vulnerabilidad de tipo Cross-site request forgery (CSRF) en phpMyAdmin anterior a versión 2.11.7.1, permite a atacantes remotos re... • http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2008-3032
https://notcve.org/view.php?id=CVE-2008-3032
07 Jul 2008 — Cross-site scripting (XSS) vulnerability in the phpMyAdmin (phpmyadmin) extension 3.0.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la extensión phpMyAdmin (phpmyadmin) 3.0.1 y versiones anteriores para TYPO3 permite a atacantes remotos inyectar web script o HTML de su elección a través de vectores no especificados. • http://secunia.com/advisories/30884 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •