Search for vulnerabilities
Vulnerability details: VCID-jjfk-u9s4-97hp
Vulnerability ID VCID-jjfk-u9s4-97hp
Aliases CVE-2011-2508
GHSA-q6vw-39cg-wjjf
Summary phpMyAdmin Directory Traversal vulnerability Directory traversal vulnerability in libraries/display_tbl.lib.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1, when a certain MIME transformation feature is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in a GLOBALS[mime_map][$meta->name][transformation] parameter.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual HIGH http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html
generic_textual HIGH http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html
generic_textual HIGH http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=b434320eff8ca9c2fc1b043c1804f868341af9a7
generic_textual HIGH http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=b434320eff8ca9c2fc1b043c1804f868341af9a7
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
epss 0.11174 https://api.first.org/data/v1/epss?cve=CVE-2011-2508
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-q6vw-39cg-wjjf
generic_textual HIGH https://github.com/phpmyadmin/phpmyadmin
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2011-2508
generic_textual HIGH https://web.archive.org/web/20110712103138/http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt
generic_textual HIGH https://web.archive.org/web/20111109175131/http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008
generic_textual HIGH https://web.archive.org/web/20111217070727/http://www.securityfocus.com/archive/1/518804/100/0/threaded
generic_textual HIGH https://web.archive.org/web/20111217173735/http://securityreason.com/securityalert/8306
generic_textual HIGH https://web.archive.org/web/20250218012437/http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html
generic_textual HIGH http://www.debian.org/security/2011/dsa-2286
generic_textual HIGH http://www.mandriva.com/security/advisories?name=MDVSA-2011:124
generic_textual HIGH http://www.openwall.com/lists/oss-security/2011/06/28/2
generic_textual HIGH http://www.openwall.com/lists/oss-security/2011/06/28/6
generic_textual HIGH http://www.openwall.com/lists/oss-security/2011/06/28/8
generic_textual HIGH http://www.openwall.com/lists/oss-security/2011/06/29/11
generic_textual HIGH http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php
Reference id Reference type URL
http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html
http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=b434320eff8ca9c2fc1b043c1804f868341af9a7
http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=b434320eff8ca9c2fc1b043c1804f868341af9a7
https://api.first.org/data/v1/epss?cve=CVE-2011-2508
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2508
https://github.com/phpmyadmin/phpmyadmin
https://nvd.nist.gov/vuln/detail/CVE-2011-2508
https://web.archive.org/web/20110712103138/http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt
https://web.archive.org/web/20111109175131/http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008
https://web.archive.org/web/20111217070727/http://www.securityfocus.com/archive/1/518804/100/0/threaded
https://web.archive.org/web/20111217173735/http://securityreason.com/securityalert/8306
https://web.archive.org/web/20250218012437/http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html
http://www.debian.org/security/2011/dsa-2286
http://www.mandriva.com/security/advisories?name=MDVSA-2011:124
http://www.openwall.com/lists/oss-security/2011/06/28/2
http://www.openwall.com/lists/oss-security/2011/06/28/6
http://www.openwall.com/lists/oss-security/2011/06/28/8
http://www.openwall.com/lists/oss-security/2011/06/29/11
http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php
GHSA-q6vw-39cg-wjjf https://github.com/advisories/GHSA-q6vw-39cg-wjjf
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.93201
EPSS Score 0.11174
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T09:15:49.358985+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-q6vw-39cg-wjjf/GHSA-q6vw-39cg-wjjf.json 37.0.0