Description
Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name for a MySQL table.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | phpmyadmin | 4:3.2.2.1-1 | — |
| Debian 13 | phpmyadmin | 4:3.2.2.1-1 | — |
| Debian 12 | phpmyadmin | 4:3.2.2.1-1 | — |
| Debian 5.0 | phpmyadmin | 4:2.11.8.1-5+lenny3 | DSA-1918-1 |
| Debian 4.0 | phpmyadmin | 4:2.9.1.1-13 | DSA-1918-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | phpmyadmin/phpmyadmin | >= 2.11.0, < 2.11.9.6 | 2.11.9.6 | GHSA-5pvv-f8h3-gw96 |
| Packagist | phpmyadmin/phpmyadmin | >= 3.0.0, < 3.2.2.1 | 3.2.2.1 | GHSA-5pvv-f8h3-gw96 |
Advisories 1
- DSA-1918-1 phpmyadmin - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://typo3.org/extensions/repository/view/phpmyadmin/4.5.0/
- http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-015/
- http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php
- http://freshmeat.net/projects/phpmyadmin/releases/306667
- phpmyadmin-tablename-xss(53742) vdb-entry
- FEDORA-2009-10530 vendor-advisory
- http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html
- https://bugzilla.redhat.com/show_bug.cgi?id=528769
- [oss-security] 20091014 CVE Request -- phpMyAdmin mailing-list
- http://freshmeat.net/projects/phpmyadmin/releases/306669
- [oss-security] 20091015 Re: CVE Request -- phpMyAdmin mailing-list
- FEDORA-2009-10510 vendor-advisory
- ADV-2009-2899 vdb-entry
- http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html
- http://bugs.gentoo.org/show_bug.cgi?id=288899
- 36658 vdb-entry
- SUSE-SR:2009:017 vendor-advisory
- 37016 third-party-advisory
- MDVSA-2009:274 vendor-advisory