Search for packages
| purl | pkg:deb/debian/phpmyadmin@0?distro=trixie |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-5288-gx4v-7bh4 | phpMyAdmin Unsafe Fetching of Javascript Code phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code. |
CVE-2012-5368
GHSA-xpxp-v33m-5jp9 |
| VCID-9auw-hwad-ybaf | Improper Authentication An issue was discovered in phpMyAdm in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for allowed pages. |
CVE-2018-12613
GHSA-x394-g9j8-x7mf |
| VCID-cb4p-81h2-h7cb | Multiple vulnerabilities have been found in phpMyAdmin, allowing remote authenticated attackers to execute arbitrary code, inject SQL code or conduct other attacks. |
CVE-2013-3238
|
| VCID-fchc-55te-akhe | Cross-site Scripting An issue was discovered in phpMyAdm. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature. |
CVE-2018-15605
GHSA-c958-4j9x-q7w4 |
| VCID-fhw5-5mdt-7ff3 | Multiple CRLF injection vulnerabilities in PhpMyAdmin 2.7.0-pl2 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a phpMyAdmin cookie in (1) css/phpmyadmin.css.php, (2) db_create.php, (3) index.php, (4) left.php, (5) libraries/session.inc.php, (6) libraries/transformations/overview.php, (7) querywindow.php, (8) server_engines.php, and possibly other files. |
CVE-2006-6374
|
| VCID-kke6-fqmn-pug2 | phpMyAdmin multiple cross-site scripting vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a procedure, or (3) a trigger. |
CVE-2012-5339
GHSA-rfpg-2fp8-2fph |
| VCID-ktmy-w9g2-1fav | Multiple vulnerabilities have been found in phpMyAdmin, the worst of which could lead to arbitrary code execution. |
CVE-2016-5098
|
| VCID-nr3p-zfc2-p7ac | export.php (aka the export script) in phpMyAdmin 4.x before 4.0.0-rc3 overwrites global variables on the basis of the contents of the POST superglobal array, which allows remote authenticated users to inject values via a crafted request. |
CVE-2013-3241
|
| VCID-q6z8-dgxc-h3fr | phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modification (Trojan Horse) in server_sync.php, which allows remote attackers to execute arbitrary PHP code via an eval injection attack. |
CVE-2012-5159
|
| VCID-sgc1-f332-byfu | phpMyAdmin leaves the SQL install script with insecure permissions, potentially leading to a database compromise. |
CVE-2005-1392
|
| VCID-tbnx-nuzv-ebdc | Cross-Site Request Forgery (CSRF) phpMyAdmin versions is vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping or truncating tables etc. |
CVE-2017-1000499
GHSA-f9hx-5jq4-fgjm |
| VCID-u32z-czfc-qbe1 | Multiple flaws in phpMyAdmin may lead to several XSS issues and local and remote file inclusion vulnerabilities. |
CVE-2005-4079
|
| VCID-uxne-zpub-tffp | Multiple vulnerabilities have been found in phpMyAdmin, allowing remote authenticated attackers to execute arbitrary code, inject SQL code or conduct other attacks. |
CVE-2013-1937
|
| VCID-xae2-3cvs-kuex | Directory traversal vulnerability in the Export feature in phpMyAdmin 4.x before 4.0.0-rc3 allows remote authenticated users to read arbitrary files or possibly have unspecified other impact via a parameter that specifies a crafted export type. |
CVE-2013-3240
|