133 results · Feed
-
High 7.5
phpMyAdmin DoS Vulnerability
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality
-
High 8.8
phpMyAdmin SSRF in replication
phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL server
-
High 8.6
phpMyAdmin server-side request forgery (SSRF)
The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
-
Unscored —
An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after a…
-
Medium 4.3
phpMyAdmin allows to detect if user is logged in
An issue was discovered in phpMyAdmin. An attacker can determine whether a user is logged in to phpMyAdmin. The user's session, username, and password are not compromised by this vulnerability. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4…
-
Unscored —
An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php.…
-
Unscored —
An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL inj…
-
Critical 9.8
phpMyAdmin Authentication Bypass
An issue was discovered in phpMyAdmin involving the $cfg['ArbitraryServerRegexp'] configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by ArbitraryServerRegexp. All 4.6.x versions (prior to 4.6.4), 4…
-
High 8.8
phpMyAdmin PHP code injection
An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10…
-
Unscored —
An issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize() function without verification that …
-
Medium 6.5
phpMyAdmin Local file exposure
An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17…
-
Medium 5.9
phpMyAdmin IPv6 and proxy server IP-based authentication rule circumvention
An issue was discovered in phpMyAdmin involving improper enforcement of the IP-based authentication rules. When phpMyAdmin is used with IPv6 in a proxy server environment, and the proxy server is in the allowed range but the attacking computer is not allowed,…
-
Medium 5.3
phpMyAdmin Local file exposure through symlinks with UploadDir
An issue was discovered in phpMyAdmin. A user can specially craft a symlink on disk, to a file which phpMyAdmin is permitted to read but the user is not, which phpMyAdmin will then expose to the user. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior…
-
Medium 6.5
phpMyAdmin Denial of service (DOS) attack in transformation feature
An issue was discovered in phpMyAdmin. The transformation feature allows a user to trigger a denial-of-service (DoS) attack against the server. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) ar…
-
Unscored —
An issue was discovered in phpMyAdmin. An attacker could redirect a user to a malicious web page. All 4.6.x versions (p…
-
Unscored —
An issue was discovered in phpMyAdmin. In the "User group" and "Designer" features, a user can execute an SQL injection…
-
Unscored —
XSS issues were discovered in phpMyAdmin. This affects Zoom search (specially crafted column content can be used to tri…
-
Medium 6.3
phpMyAdmin Reflected File Download attack
An issue was discovered in phpMyAdmin. An attacker may be able to trigger a user to download a specially crafted malicious SVG file. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
-
Medium 6.5
phpMyAdmin DoS Vulnerability
An issue was discovered in phpMyAdmin. An authorized user can cause a denial-of-service (DoS) attack on a server by passing large values to a loop. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17…
-
Unscored —
An issue was discovered in phpMyAdmin. In the user interface preference feature, a user can execute an SQL injection at…
-
Unscored —
An issue was discovered in phpMyAdmin. A user can execute a remote code execution attack against a server when phpMyAdm…
-
Unscored —
An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir …
-
Unscored —
An issue was discovered in phpMyAdmin. An authenticated user can trigger a denial-of-service (DoS) attack by entering a…
-
Medium 5.9
phpMyAdmin DoS Vulnerability
An issue was discovered in phpMyAdmin. An unauthenticated user is able to execute a denial-of-service (DoS) attack by forcing persistent connections when phpMyAdmin is running with $cfg['AllowArbitraryServer']=true. All 4.6.x versions (prior to 4.6.4), 4.4.x …
-
Unscored —
A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error in the ex…
-
Unscored —
XSS issues were discovered in phpMyAdmin. This affects navigation pane and database/table hiding feature (a specially-c…
-
Medium 5.9
phpMyAdmin Denial of service (DOS) attack with dbase extension
An issue was discovered in phpMyAdmin where, under certain conditions, phpMyAdmin may not delete temporary files during the import of ESRI files. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) …
-
Unscored —
An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a …
-
High 8.1
phpMyAdmin Remote code execution vulnerability when PHP is running with dbase extension
An issue was discovered in phpMyAdmin. phpMyAdmin can be used to trigger a remote code execution attack against certain PHP installations that are running with the dbase extension. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4…
-
Unscored —
An issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible to bypass the protect…
-
Medium 5.3
phpMyAdmin path disclosure
An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. D…
-
Unscored —
An issue was discovered in phpMyAdmin. Username matching for the allow/deny rules may result in wrong matches and detec…
-
Medium 5.3
phpMyAdmin Bypass logout timeout
An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to bypass the logout timeout. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected.
-
Unscored —
An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is …
-
Critical 9.8
phpMyAdmin CSRF Vulnerability
An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.…
-
Medium 5.3
phpMyAdmin Cryptographic Vulnerability
An issue was discovered in phpMyAdmin. When the user does not specify a blowfish_secret key for encrypting cookies, phpMyAdmin generates one at runtime. A vulnerability was reported where the way this value is created uses a weak algorithm. This could allow a…
-
Unscored —
An issue was discovered in phpMyAdmin. phpinfo (phpinfo.php) shows PHP information including values of HttpOnly cookies…
-
Medium 6.1
phpMyAdmin XSS Vulnerability
An issue was discovered in phpMyAdmin. XSS is possible because of a weakness in a regular expression used in some JavaScript processing. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affec…
-
Medium 6.1
phpMyAdmin XSS Vulnerability
An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4…
-
Unscored —
An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of se…