Description
Multiple cross-site scripting (XSS) vulnerabilities in the table Print view implementation in tbl_printview.php in phpMyAdmin before 3.3.10.3 and 3.4.x before 3.4.3.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | phpmyadmin | 4:3.4.3.2-1 | — |
| Debian 13 | phpmyadmin | 4:3.4.3.2-1 | — |
| Debian 12 | phpmyadmin | 4:3.4.3.2-1 | — |
| Debian 6.0 | phpmyadmin | 4:3.3.7-6 | DSA-2286-1 |
| Debian 5.0 | phpmyadmin | 4:2.11.8.1-5+lenny9 | DSA-2286-1 |
Advisories 1
- DSA-2286-1 phpymadmin - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 45515 third-party-advisory
- 45365 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=725381
- 48874 vdb-entry
- http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=a0823be05aa5835f207c0838b9cca67d2d9a050a
- MDVSA-2011:124 vendor-advisory
- http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=4bd27166c314faa37cada91533b86377f4d4d214
- DSA-2286 vendor-advisory
- FEDORA-2011-9725 vendor-advisory
- FEDORA-2011-9734 vendor-advisory
- 45315 third-party-advisory
- http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php
- phpmyadmin-table-print-xss(68750) vdb-entry