CVSS: 5.5EPSS: 11%CPEs: 2EXPL: 0CVE-2023-25727
https://notcve.org/view.php?id=CVE-2023-25727
13 Feb 2023 — In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface. • https://www.phpmyadmin.net/security/PMASA-2023-1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-0813 – PhpMyAdmin exposure of sensitive information
https://notcve.org/view.php?id=CVE-2022-0813
09 Mar 2022 — PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section. PhpMyAdmin versiones 5.1.1 y anteriores, permiten a un atacante recuperar información potencialmente confidencial creando peticiones no válidas. Esto afecta al parámetro lang, al parámetro pma_ y a la cookie section Multiple vulnerabilities have been discovered in phpMyAdmin, the worst of which allows for denial... • https://security.gentoo.org/glsa/202311-17 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-22278
https://notcve.org/view.php?id=CVE-2020-22278
04 Nov 2020 — phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because "the CSV file is accurately generated based on the database contents. ** EN DISPUTA ** phpMyAdmin versiones hasta 5.0.2, permite una inyección CSV por medio de una Export SectionNOTA: el vendedor lo discute porque "el archivo CSV se genera con precisión en base al contenido de la base de datos" • https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22278.pdf • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 9.8EPSS: 1%CPEs: 3EXPL: 0CVE-2019-19617
https://notcve.org/view.php?id=CVE-2019-19617
06 Dec 2019 — phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php. phpMyAdmin versiones anteriores a 4.9.2 no escapa determinada información de Git, relacionada con las bibliotecas libraries/classes/Display/GitRevision.php y libraries/classes/Footer.php. • https://github.com/phpmyadmin/phpmyadmin/commit/1119de642b136d20e810bb20f545069a01dd7cc9 •
CVSS: 9.8EPSS: 0%CPEs: 7EXPL: 0CVE-2019-18622 – Gentoo Linux Security Advisory 202003-39
https://notcve.org/view.php?id=CVE-2019-18622
22 Nov 2019 — An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature. Se detectó un problema en phpMyAdmin versiones anteriores a 4.9.2. Se puede utilizar un nombre de base de datos/tabla diseñado para desencadenar un ataque de inyección SQL por medio de la funcionalidad designer. An SQL injection vulnerability in phpMyAdmin may allow attackers to execute arbitrary SQL statements. • http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00002.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 37%CPEs: 4EXPL: 4CVE-2019-12922 – phpMyAdmin 4.9.0.1 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2019-12922
13 Sep 2019 — A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page. Un problema de tipo CSRF en phpMyAdmin versión 4.9.0.1, permite la eliminación de cualquier servidor en la página de Setup. phpMyAdmin version 4.9.0.1 suffers from a cross site request forgery vulnerability. • https://packetstorm.news/files/id/154483 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 59%CPEs: 1EXPL: 3CVE-2019-12616 – phpMyAdmin 4.8 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2019-12616
05 Jun 2019 — An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim. Un problema fue descubierto en phpMyAdmin antes del 4.9.0. Fue descubierta una vulnerabilidad que permite a un atacante desen... • https://packetstorm.news/files/id/153251 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2019-11768 – Ubuntu Security Notice USN-4639-1
https://notcve.org/view.php?id=CVE-2019-11768
05 Jun 2019 — An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature. Fue descubierto un problema en phpMyAdmin anterior de la versión d 4.9.0.1. Se informó de una vulnerabilidad en la que se puede utilizar un nombre de base de datos especialmente diseñado para desencadenar un ataque de inyección de SQL a través de la función del diseñador. It was discovered that there was a bug ... • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 1%CPEs: 1EXPL: 0CVE-2018-15605
https://notcve.org/view.php?id=CVE-2018-15605
24 Aug 2018 — An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature. Se ha descubierto un problema en versiones anteriores a la 4.8.3 de phpMyAdmin. Se ha encontrado una vulnerabilidad de Cross-Site Scripting (XSS) en la que un atacante puede emplear un archivo manipulado para manipular un usuario autenticado que cargue ese archivo mediante la caract... • http://www.securityfocus.com/bid/105168 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 1%CPEs: 1EXPL: 0CVE-2018-12581
https://notcve.org/view.php?id=CVE-2018-12581
21 Jun 2018 — An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature. Se ha descubierto un problema en js/designer/move.js en versiones anteriores a la 4.8.2 de phpMyAdmin. Se ha encontrado una vulnerabilidad de Cross-Site Scripting (XSS) en la que un atacante puede emplear un nombre de base de datos manipulado para de... • http://www.securityfocus.com/bid/104530 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •