phpMyAdmin security announcements

PMASA-2023-1

phpMyAdmin Security Team — Tue, 07 Feb 2023 17:41:50 +0000

XSS vulnerability in drag-and-drop upload

Affected Versions

phpMyAdmin versions prior to 4.9.11 and 5.2.1 are affected. The vulnerability has existed since release version 4.3.0.

CVE ID

CVE-2023-25727

PMASA-2022-2

phpMyAdmin Security Team — Mon, 10 Jan 2022 17:48:37 +0000

Multiple XSS and HTML injection attacks in setup script

Affected Versions

phpMyAdmin versions of the 5.1 branch prior to 5.1.2 are affected.

CVE ID

CVE-2022-23808

PMASA-2022-1

phpMyAdmin Security Team — Mon, 10 Jan 2022 17:01:34 +0000

Two factor authentication bypass

Affected Versions

phpMyAdmin versions of the 4.9 branch prior to 4.9.8 and 5.1 prior to 5.1.2 are affected.

CVE ID

CVE-2022-23807

PMASA-2020-6

phpMyAdmin Security Team — Sat, 10 Oct 2020 00:38:32 +0000

SQL injection vulnerability in SearchController

Affected Versions

phpMyAdmin 4.9.x releases prior to 4.9.6 and the 5.0.x releases prior to 5.0.3 are affected.

CVE ID

CVE-2020-26935

PMASA-2020-5

phpMyAdmin Security Team — Sat, 10 Oct 2020 00:19:36 +0000

XSS relating to the transformation feature

Affected Versions

phpMyAdmin 4.9.x releases prior to 4.9.6 and the 5.0.x releases prior to 5.0.3 are affected. We believe the flaw was introduced with phpMyAdmin 2.5.0.

CVE ID

CVE-2020-26934

PMASA-2020-4

phpMyAdmin Security Team — Fri, 20 Mar 2020 12:00:00 +0000

SQL injection relating to data display

Affected Versions

phpMyAdmin 4.9.x releases prior to 4.9.5 and the 5.0.x releases prior to 5.0.2 are affected. We believe the flaw was introduced with phpMyAdmin 3.4.

CVE ID

CVE-2020-10803

PMASA-2020-3

phpMyAdmin Security Team — Fri, 20 Mar 2020 12:00:00 +0000

SQL injection relating to searching

Affected Versions

phpMyAdmin 4.9.x releases prior to 4.9.5 and the 5.0.x releases prior to 5.0.2 are affected.

CVE ID

CVE-2020-10802

PMASA-2020-2

phpMyAdmin Security Team — Fri, 20 Mar 2020 12:00:00 +0000

SQL injection with processing username

Affected Versions

phpMyAdmin 4.9.x releases prior to 4.9.5 and the 5.0.x releases prior to 5.0.2 are affected.

CVE ID

CVE-2020-10804

PMASA-2020-1

phpMyAdmin Security Team — Sun, 05 Jan 2020 14:36:53 +0000

SQL injection in user accounts page

Affected Versions

phpMyAdmin 4.x versions prior to 4.9.4 are affected, at least as old as 4.0.0. phpMyAdmin 5.x version 5.0.0 is affected.

CVE ID

CVE-2020-5504

PMASA-2019-5

phpMyAdmin Security Team — Mon, 28 Oct 2019 14:05:40 +0000

SQL injection in Designer feature

Affected Versions

phpMyAdmin versions prior to 4.9.2 are affected, at least as old as 4.7.7.

CVE ID

CVE-2019-18622