usn-4639-1
Vulnerability from osv_ubuntu
Published
2020-11-19 15:01
Modified
2026-04-27 14:11
Summary
phpmyadmin vulnerabilities
Details
It was discovered that there was a bug in the way phpMyAdmin handles the phpMyAdmin Configuration Storage tables. An authenticated attacker could use this vulnerability to cause phpmyAdmin to leak sensitive files. (CVE-2018-19968)
It was discovered that phpMyAdmin incorrectly handled user input. An attacker could possibly use this for an XSS attack. (CVE-2018-19970)
It was discovered that phpMyAdmin mishandled certain input. An attacker could use this vulnerability to execute a cross-site scripting (XSS) attack via a crafted URL. (CVE-2018-7260)
It was discovered that phpMyAdmin failed to sanitize certain input. An attacker could use this vulnerability to execute an SQL injection attack via a specially crafted database name. (CVE-2019-11768)
It was discovered that phpmyadmin incorrectly handled some requests. An attacker could possibly use this to perform a CSRF attack. (CVE-2019-12616)
It was discovered that phpMyAdmin failed to sanitize certain input. An attacker could use this vulnerability to execute an SQL injection attack via a specially crafted username. (CVE-2019-6798, CVE-2020-10804, CVE-2020-5504)
It was discovered that phpMyAdmin would allow sensitive files to be leaked if certain configuration options were set. An attacker could use this vulnerability to access confidential information. (CVE-2019-6799)
It was discovered that phpMyAdmin failed to sanitize certain input. An attacker could use this vulnerability to execute an SQL injection attack via a specially crafted database or table name. (CVE-2020-10802)
It was discovered that phpMyAdmin did not properly handle data from the database when displaying it. If an attacker were to insert specially- crafted data into certain database tables, the attacker could execute a cross-site scripting (XSS) attack. (CVE-2020-10803)
It was discovered that phpMyAdmin was vulnerable to an XSS attack. If a victim were to click on a crafted link, an attacker could run malicious JavaScript on the victim's system. (CVE-2020-26934)
It was discovered that phpMyAdmin did not properly handler certain SQL statements in the search feature. An attacker could use this vulnerability to inject malicious SQL into a query. (CVE-2020-26935)
It was discovered that phpMyAdmin did not properly sanitize certain input. An attacker could use this vulnerability to possibly execute an HTML injection or a cross-site scripting (XSS) attack. (CVE-2019-19617)
References
{
"affected": [
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2018-7260",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-19968",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-19970",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2019-6798",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2019-6799",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2019-11768",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2019-12616",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2019-19617",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2020-5504",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2020-10802",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2020-10803",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2020-10804",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2020-26934",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2020-26935",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:18.04:LTS"
}
},
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.6.6-5ubuntu0.5"
}
]
},
"package": {
"ecosystem": "Ubuntu:18.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.6.6-5ubuntu0.5?arch=source\u0026distro=bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.6.6-5ubuntu0.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.6.6-5"
]
}
],
"aliases": [],
"details": "It was discovered that there was a bug in the way phpMyAdmin handles the\nphpMyAdmin Configuration Storage tables. An authenticated attacker could\nuse this vulnerability to cause phpmyAdmin to leak sensitive files.\n(CVE-2018-19968)\n\nIt was discovered that phpMyAdmin incorrectly handled user input. An\nattacker could possibly use this for an XSS attack. (CVE-2018-19970)\n\nIt was discovered that phpMyAdmin mishandled certain input. An attacker\ncould use this vulnerability to execute a cross-site scripting (XSS) attack\nvia a crafted URL. (CVE-2018-7260)\n\nIt was discovered that phpMyAdmin failed to sanitize certain input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted database name. (CVE-2019-11768)\n\nIt was discovered that phpmyadmin incorrectly handled some requests. An\nattacker could possibly use this to perform a CSRF attack. (CVE-2019-12616)\n\nIt was discovered that phpMyAdmin failed to sanitize certain input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted username. (CVE-2019-6798, CVE-2020-10804,\nCVE-2020-5504)\n\nIt was discovered that phpMyAdmin would allow sensitive files to be leaked\nif certain configuration options were set. An attacker could use this\nvulnerability to access confidential information. (CVE-2019-6799)\n\nIt was discovered that phpMyAdmin failed to sanitize certain input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted database or table name. (CVE-2020-10802)\n\nIt was discovered that phpMyAdmin did not properly handle data from the\ndatabase when displaying it. If an attacker were to insert specially-\ncrafted data into certain database tables, the attacker could execute a\ncross-site scripting (XSS) attack. (CVE-2020-10803)\n\nIt was discovered that phpMyAdmin was vulnerable to an XSS attack. If a\nvictim were to click on a crafted link, an attacker could run malicious\nJavaScript on the victim\u0027s system. (CVE-2020-26934)\n\nIt was discovered that phpMyAdmin did not properly handler certain SQL\nstatements in the search feature. An attacker could use this vulnerability\nto inject malicious SQL into a query. (CVE-2020-26935)\n\nIt was discovered that phpMyAdmin did not properly sanitize certain input.\nAn attacker could use this vulnerability to possibly execute an HTML injection\nor a cross-site scripting (XSS) attack. (CVE-2019-19617)\n",
"id": "USN-4639-1",
"modified": "2026-04-27T14:11:26Z",
"published": "2020-11-19T15:01:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-4639-1"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-7260"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-19968"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-19970"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2019-6798"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2019-6799"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2019-11768"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2019-12616"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2019-19617"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2020-5504"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2020-10802"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2020-10803"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2020-10804"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2020-26934"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2020-26935"
}
],
"related": [],
"schema_version": "1.7.0",
"summary": "phpmyadmin vulnerabilities",
"upstream": [
"UBUNTU-CVE-2018-7260",
"UBUNTU-CVE-2018-19968",
"UBUNTU-CVE-2018-19970",
"UBUNTU-CVE-2019-6798",
"UBUNTU-CVE-2019-6799",
"UBUNTU-CVE-2019-11768",
"UBUNTU-CVE-2019-12616",
"UBUNTU-CVE-2019-19617",
"UBUNTU-CVE-2020-5504",
"UBUNTU-CVE-2020-10802",
"UBUNTU-CVE-2020-10803",
"UBUNTU-CVE-2020-10804",
"UBUNTU-CVE-2020-26934",
"UBUNTU-CVE-2020-26935"
]
}
ubuntu-cve-2018-19968
Vulnerability from osv_ubuntu
Published
2018-12-11 17:29
Modified
2025-07-18 16:44
Summary
Details
An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.
Severity
6.5 (Medium)
N/A (UNKNOWN)
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.0.10-1ubuntu0.1+esm4"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:14.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.0.10-1ubuntu0.1+esm4?arch=source\u0026distro=trusty/esm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.0.10-1ubuntu0.1+esm4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.0.6-1",
"4:4.0.8-1",
"4:4.0.9-1",
"4:4.0.10-1",
"4:4.0.10-1ubuntu0.1",
"4:4.0.10-1ubuntu0.1+esm1",
"4:4.0.10-1ubuntu0.1+esm2",
"4:4.0.10-1ubuntu0.1+esm3"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.5.4.1-2ubuntu2.1+esm6"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.5.4.1-2ubuntu2.1+esm6?arch=source\u0026distro=esm-apps/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.5.4.1-2ubuntu2.1+esm6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.4.13.1-1",
"4:4.5.0.2-2",
"4:4.5.1-1",
"4:4.5.1-2",
"4:4.5.1-3",
"4:4.5.2-1",
"4:4.5.2-2",
"4:4.5.3.1-1",
"4:4.5.4-1",
"4:4.5.4.1-2",
"4:4.5.4.1-2ubuntu1",
"4:4.5.4.1-2ubuntu2",
"4:4.5.4.1-2ubuntu2.1",
"4:4.5.4.1-2ubuntu2.1+esm2",
"4:4.5.4.1-2ubuntu2.1+esm3",
"4:4.5.4.1-2ubuntu2.1+esm4",
"4:4.5.4.1-2ubuntu2.1+esm5"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.6.6-5ubuntu0.5"
}
]
},
"package": {
"ecosystem": "Ubuntu:18.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.6.6-5ubuntu0.5?arch=source\u0026distro=bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.6.6-5ubuntu0.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.6.6-5"
]
}
],
"aliases": [],
"details": "An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.",
"id": "UBUNTU-CVE-2018-19968",
"modified": "2025-07-18T16:44:49Z",
"published": "2018-12-11T17:29:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-19968"
},
{
"type": "REPORT",
"url": "https://www.phpmyadmin.net/security/PMASA-2018-6/"
},
{
"type": "REPORT",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/6a1ba61e29002f0305a9322a8af4eaaeb11c0732"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-4639-1"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-19968"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-4843-1"
}
],
"related": [
"USN-4639-1",
"USN-4843-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2018-19968"
]
}
ubuntu-cve-2018-19970
Vulnerability from osv_ubuntu
Published
2018-12-11 17:29
Modified
2025-07-18 16:44
Summary
Details
In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name.
Severity
6.1 (Medium)
N/A (UNKNOWN)
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.0.10-1ubuntu0.1+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:14.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.0.10-1ubuntu0.1+esm1?arch=source\u0026distro=trusty/esm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.0.10-1ubuntu0.1+esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.0.6-1",
"4:4.0.8-1",
"4:4.0.9-1",
"4:4.0.10-1",
"4:4.0.10-1ubuntu0.1"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.5.4.1-2ubuntu2.1+esm3"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.5.4.1-2ubuntu2.1+esm3?arch=source\u0026distro=esm-apps/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.5.4.1-2ubuntu2.1+esm3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.4.13.1-1",
"4:4.5.0.2-2",
"4:4.5.1-1",
"4:4.5.1-2",
"4:4.5.1-3",
"4:4.5.2-1",
"4:4.5.2-2",
"4:4.5.3.1-1",
"4:4.5.4-1",
"4:4.5.4.1-2",
"4:4.5.4.1-2ubuntu1",
"4:4.5.4.1-2ubuntu2",
"4:4.5.4.1-2ubuntu2.1",
"4:4.5.4.1-2ubuntu2.1+esm2"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.6.6-5ubuntu0.5"
}
]
},
"package": {
"ecosystem": "Ubuntu:18.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.6.6-5ubuntu0.5?arch=source\u0026distro=bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.6.6-5ubuntu0.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.6.6-5"
]
}
],
"aliases": [],
"details": "In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name.",
"id": "UBUNTU-CVE-2018-19970",
"modified": "2025-07-18T16:44:49Z",
"published": "2018-12-11T17:29:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-19970"
},
{
"type": "REPORT",
"url": "https://www.phpmyadmin.net/security/PMASA-2018-8/"
},
{
"type": "REPORT",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b293ff5f234ef493336ed8638f623a12164d359e"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-4639-1"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-19970"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-4843-1"
}
],
"related": [
"USN-4639-1",
"USN-4843-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2018-19970"
]
}
ubuntu-cve-2018-7260
Vulnerability from osv_ubuntu
Published
2018-02-21 15:29
Modified
2025-07-18 16:44
Summary
Details
Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Severity
5.4 (Medium)
N/A (UNKNOWN)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.6.6-5ubuntu0.5"
}
]
},
"package": {
"ecosystem": "Ubuntu:18.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.6.6-5ubuntu0.5?arch=source\u0026distro=bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.6.6-5ubuntu0.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.6.6-5"
]
}
],
"aliases": [],
"details": "Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.",
"id": "UBUNTU-CVE-2018-7260",
"modified": "2025-07-18T16:44:31Z",
"published": "2018-02-21T15:29:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-7260"
},
{
"type": "REPORT",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d2886a3"
},
{
"type": "REPORT",
"url": "https://www.phpmyadmin.net/security/PMASA-2018-1/"
},
{
"type": "REPORT",
"url": "https://udiniya.wordpress.com/2018/02/21/a-tale-of-stealing-session-cookie-in-phpmyadmin/"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-4639-1"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7260"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-4843-1"
}
],
"related": [
"USN-4639-1",
"USN-4843-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2018-7260"
]
}
ubuntu-cve-2019-11768
Vulnerability from osv_ubuntu
Published
2019-06-05 05:29
Modified
2025-09-08 16:45
Summary
Details
An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature.
Severity
9.8 (Critical)
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.5.4.1-2ubuntu2.1+esm3"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.5.4.1-2ubuntu2.1+esm3?arch=source\u0026distro=esm-apps/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.5.4.1-2ubuntu2.1+esm3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.4.13.1-1",
"4:4.5.0.2-2",
"4:4.5.1-1",
"4:4.5.1-2",
"4:4.5.1-3",
"4:4.5.2-1",
"4:4.5.2-2",
"4:4.5.3.1-1",
"4:4.5.4-1",
"4:4.5.4.1-2",
"4:4.5.4.1-2ubuntu1",
"4:4.5.4.1-2ubuntu2",
"4:4.5.4.1-2ubuntu2.1",
"4:4.5.4.1-2ubuntu2.1+esm2"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.6.6-5ubuntu0.5"
}
]
},
"package": {
"ecosystem": "Ubuntu:18.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.6.6-5ubuntu0.5?arch=source\u0026distro=bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.6.6-5ubuntu0.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.6.6-5"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:5.1.1+dfsg1-5ubuntu1"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:5.1.1+dfsg1-5ubuntu1?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:5.0.4+dfsg2-2ubuntu5",
"4:5.1.1+dfsg1-5ubuntu1"
]
}
],
"aliases": [],
"details": "An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature.",
"id": "UBUNTU-CVE-2019-11768",
"modified": "2025-09-08T16:45:25Z",
"published": "2019-06-05T05:29:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2019-11768"
},
{
"type": "REPORT",
"url": "https://www.phpmyadmin.net/security/PMASA-2019-3/"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-4639-1"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-4843-1"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11768"
}
],
"related": [
"USN-4639-1",
"USN-4843-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2019-11768"
]
}
ubuntu-cve-2019-12616
Vulnerability from osv_ubuntu
Published
2019-06-05 05:29
Modified
2025-07-18 16:45
Summary
Details
An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim.
Severity
6.5 (Medium)
N/A (UNKNOWN)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.0.10-1ubuntu0.1+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:14.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.0.10-1ubuntu0.1+esm1?arch=source\u0026distro=trusty/esm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.0.10-1ubuntu0.1+esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.0.6-1",
"4:4.0.8-1",
"4:4.0.9-1",
"4:4.0.10-1",
"4:4.0.10-1ubuntu0.1"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.5.4.1-2ubuntu2.1+esm3"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.5.4.1-2ubuntu2.1+esm3?arch=source\u0026distro=esm-apps/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.5.4.1-2ubuntu2.1+esm3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.4.13.1-1",
"4:4.5.0.2-2",
"4:4.5.1-1",
"4:4.5.1-2",
"4:4.5.1-3",
"4:4.5.2-1",
"4:4.5.2-2",
"4:4.5.3.1-1",
"4:4.5.4-1",
"4:4.5.4.1-2",
"4:4.5.4.1-2ubuntu1",
"4:4.5.4.1-2ubuntu2",
"4:4.5.4.1-2ubuntu2.1",
"4:4.5.4.1-2ubuntu2.1+esm2"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.6.6-5ubuntu0.5"
}
]
},
"package": {
"ecosystem": "Ubuntu:18.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.6.6-5ubuntu0.5?arch=source\u0026distro=bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.6.6-5ubuntu0.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.6.6-5"
]
}
],
"aliases": [],
"details": "An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken \u003cimg\u003e tag pointing at the victim\u0027s phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim.",
"id": "UBUNTU-CVE-2019-12616",
"modified": "2025-07-18T16:45:10Z",
"published": "2019-06-05T05:29:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2019-12616"
},
{
"type": "REPORT",
"url": "https://www.phpmyadmin.net/security/PMASA-2019-4/"
},
{
"type": "REPORT",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/015c404038c44279d95b6430ee5a0dddc97691ec"
},
{
"type": "REPORT",
"url": "https://www.phpmyadmin.net/security/"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-4639-1"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12616"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-4843-1"
}
],
"related": [
"USN-4639-1",
"USN-4843-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2019-12616"
]
}
ubuntu-cve-2019-19617
Vulnerability from osv_ubuntu
Published
2019-12-06 03:15
Modified
2025-07-18 16:45
Summary
Details
phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.
Severity
9.8 (Critical)
N/A (UNKNOWN)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.0.10-1ubuntu0.1+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:14.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.0.10-1ubuntu0.1+esm2?arch=source\u0026distro=trusty/esm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.0.10-1ubuntu0.1+esm2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.0.6-1",
"4:4.0.8-1",
"4:4.0.9-1",
"4:4.0.10-1",
"4:4.0.10-1ubuntu0.1",
"4:4.0.10-1ubuntu0.1+esm1"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.5.4.1-2ubuntu2.1+esm4"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.5.4.1-2ubuntu2.1+esm4?arch=source\u0026distro=esm-apps/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.5.4.1-2ubuntu2.1+esm4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.4.13.1-1",
"4:4.5.0.2-2",
"4:4.5.1-1",
"4:4.5.1-2",
"4:4.5.1-3",
"4:4.5.2-1",
"4:4.5.2-2",
"4:4.5.3.1-1",
"4:4.5.4-1",
"4:4.5.4.1-2",
"4:4.5.4.1-2ubuntu1",
"4:4.5.4.1-2ubuntu2",
"4:4.5.4.1-2ubuntu2.1",
"4:4.5.4.1-2ubuntu2.1+esm2",
"4:4.5.4.1-2ubuntu2.1+esm3"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.6.6-5ubuntu0.5"
}
]
},
"package": {
"ecosystem": "Ubuntu:18.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.6.6-5ubuntu0.5?arch=source\u0026distro=bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.6.6-5ubuntu0.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.6.6-5"
]
}
],
"aliases": [],
"details": "phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.",
"id": "UBUNTU-CVE-2019-19617",
"modified": "2025-07-18T16:45:31Z",
"published": "2019-12-06T03:15:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2019-19617"
},
{
"type": "REPORT",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1119de642b136d20e810bb20f545069a01dd7cc9"
},
{
"type": "REPORT",
"url": "https://github.com/phpmyadmin/phpmyadmin/compare/RELEASE_4_9_1...RELEASE_4_9_2"
},
{
"type": "REPORT",
"url": "https://www.phpmyadmin.net/news/2019/11/22/phpmyadmin-492-released/"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-4639-1"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19617"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-4843-1"
}
],
"related": [
"USN-4639-1",
"USN-4843-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2019-19617"
]
}
ubuntu-cve-2019-6798
Vulnerability from osv_ubuntu
Published
2019-01-26 17:29
Modified
2025-07-18 16:45
Summary
Details
An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature.
Severity
9.8 (Critical)
N/A (UNKNOWN)
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.5.4.1-2ubuntu2.1+esm3"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.5.4.1-2ubuntu2.1+esm3?arch=source\u0026distro=esm-apps/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.5.4.1-2ubuntu2.1+esm3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.4.13.1-1",
"4:4.5.0.2-2",
"4:4.5.1-1",
"4:4.5.1-2",
"4:4.5.1-3",
"4:4.5.2-1",
"4:4.5.2-2",
"4:4.5.3.1-1",
"4:4.5.4-1",
"4:4.5.4.1-2",
"4:4.5.4.1-2ubuntu1",
"4:4.5.4.1-2ubuntu2",
"4:4.5.4.1-2ubuntu2.1",
"4:4.5.4.1-2ubuntu2.1+esm2"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.6.6-5ubuntu0.5"
}
]
},
"package": {
"ecosystem": "Ubuntu:18.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.6.6-5ubuntu0.5?arch=source\u0026distro=bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.6.6-5ubuntu0.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.6.6-5"
]
}
],
"aliases": [],
"details": "An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature.",
"id": "UBUNTU-CVE-2019-6798",
"modified": "2025-07-18T16:45:00Z",
"published": "2019-01-26T17:29:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2019-6798"
},
{
"type": "REPORT",
"url": "https://www.phpmyadmin.net/security/PMASA-2019-2/"
},
{
"type": "REPORT",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/469934cf7d3bd19a839eb78670590f7511399435"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-4639-1"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6798"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-4843-1"
}
],
"related": [
"USN-4639-1",
"USN-4843-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2019-6798"
]
}
ubuntu-cve-2019-6799
Vulnerability from osv_ubuntu
Published
2019-01-26 17:29
Modified
2025-09-08 16:45
Summary
Details
An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of "options(MYSQLI_OPT_LOCAL_INFILE" calls.
Severity
5.9 (Medium)
N/A (UNKNOWN)
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.0.10-1ubuntu0.1+esm4"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:14.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.0.10-1ubuntu0.1+esm4?arch=source\u0026distro=esm-infra-legacy/trusty"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.0.6-1",
"4:4.0.8-1",
"4:4.0.9-1",
"4:4.0.10-1",
"4:4.0.10-1ubuntu0.1",
"4:4.0.10-1ubuntu0.1+esm1",
"4:4.0.10-1ubuntu0.1+esm2",
"4:4.0.10-1ubuntu0.1+esm3",
"4:4.0.10-1ubuntu0.1+esm4"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.5.4.1-2ubuntu2.1+esm6"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.5.4.1-2ubuntu2.1+esm6?arch=source\u0026distro=esm-apps/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.4.13.1-1",
"4:4.5.0.2-2",
"4:4.5.1-1",
"4:4.5.1-2",
"4:4.5.1-3",
"4:4.5.2-1",
"4:4.5.2-2",
"4:4.5.3.1-1",
"4:4.5.4-1",
"4:4.5.4.1-2",
"4:4.5.4.1-2ubuntu1",
"4:4.5.4.1-2ubuntu2",
"4:4.5.4.1-2ubuntu2.1",
"4:4.5.4.1-2ubuntu2.1+esm2",
"4:4.5.4.1-2ubuntu2.1+esm3",
"4:4.5.4.1-2ubuntu2.1+esm4",
"4:4.5.4.1-2ubuntu2.1+esm5",
"4:4.5.4.1-2ubuntu2.1+esm6"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.6.6-5ubuntu0.5"
}
]
},
"package": {
"ecosystem": "Ubuntu:18.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.6.6-5ubuntu0.5?arch=source\u0026distro=bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.6.6-5ubuntu0.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.6.6-5"
]
}
],
"aliases": [],
"details": "An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server\u0027s user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of \"options(MYSQLI_OPT_LOCAL_INFILE\" calls.",
"id": "UBUNTU-CVE-2019-6799",
"modified": "2025-09-08T16:45:16Z",
"published": "2019-01-26T17:29:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2019-6799"
},
{
"type": "REPORT",
"url": "https://www.phpmyadmin.net/security/PMASA-2019-1/"
},
{
"type": "REPORT",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/aeac90623e525057a7672ab3d98154b5c57c15ec"
},
{
"type": "REPORT",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c5e01f84ad48c5c626001cb92d7a95500920a900"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-4639-1"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6799"
}
],
"related": [
"USN-4639-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2019-6799"
]
}
ubuntu-cve-2020-10802
Vulnerability from osv_ubuntu
Published
2020-03-22 05:15
Modified
2025-09-08 16:46
Summary
Details
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.
Severity
8.0 (High)
N/A (UNKNOWN)
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.0.10-1ubuntu0.1+esm4"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:14.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.0.10-1ubuntu0.1+esm4?arch=source\u0026distro=esm-infra-legacy/trusty"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.0.6-1",
"4:4.0.8-1",
"4:4.0.9-1",
"4:4.0.10-1",
"4:4.0.10-1ubuntu0.1",
"4:4.0.10-1ubuntu0.1+esm1",
"4:4.0.10-1ubuntu0.1+esm2",
"4:4.0.10-1ubuntu0.1+esm3",
"4:4.0.10-1ubuntu0.1+esm4"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.5.4.1-2ubuntu2.1+esm6"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.5.4.1-2ubuntu2.1+esm6?arch=source\u0026distro=esm-apps/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.4.13.1-1",
"4:4.5.0.2-2",
"4:4.5.1-1",
"4:4.5.1-2",
"4:4.5.1-3",
"4:4.5.2-1",
"4:4.5.2-2",
"4:4.5.3.1-1",
"4:4.5.4-1",
"4:4.5.4.1-2",
"4:4.5.4.1-2ubuntu1",
"4:4.5.4.1-2ubuntu2",
"4:4.5.4.1-2ubuntu2.1",
"4:4.5.4.1-2ubuntu2.1+esm2",
"4:4.5.4.1-2ubuntu2.1+esm3",
"4:4.5.4.1-2ubuntu2.1+esm4",
"4:4.5.4.1-2ubuntu2.1+esm5",
"4:4.5.4.1-2ubuntu2.1+esm6"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.6.6-5ubuntu0.5"
}
]
},
"package": {
"ecosystem": "Ubuntu:18.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.6.6-5ubuntu0.5?arch=source\u0026distro=bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.6.6-5ubuntu0.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.6.6-5"
]
}
],
"aliases": [],
"details": "In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.",
"id": "UBUNTU-CVE-2020-10802",
"modified": "2025-09-08T16:46:03Z",
"published": "2020-03-22T05:15:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2020-10802"
},
{
"type": "REPORT",
"url": "https://www.phpmyadmin.net/security/PMASA-2020-3/"
},
{
"type": "REPORT",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/a8acd7a42cf743186528b0453f90aaa32bfefabe"
},
{
"type": "REPORT",
"url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-4639-1"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10802"
}
],
"related": [
"USN-4639-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2020-10802"
]
}
ubuntu-cve-2020-10803
Vulnerability from osv_ubuntu
Published
2020-03-22 05:15
Modified
2025-09-08 16:46
Summary
Details
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.
Severity
5.4 (Medium)
N/A (UNKNOWN)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.0.10-1ubuntu0.1+esm4"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:14.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.0.10-1ubuntu0.1+esm4?arch=source\u0026distro=esm-infra-legacy/trusty"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.0.6-1",
"4:4.0.8-1",
"4:4.0.9-1",
"4:4.0.10-1",
"4:4.0.10-1ubuntu0.1",
"4:4.0.10-1ubuntu0.1+esm1",
"4:4.0.10-1ubuntu0.1+esm2",
"4:4.0.10-1ubuntu0.1+esm3",
"4:4.0.10-1ubuntu0.1+esm4"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.5.4.1-2ubuntu2.1+esm6"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.5.4.1-2ubuntu2.1+esm6?arch=source\u0026distro=esm-apps/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.4.13.1-1",
"4:4.5.0.2-2",
"4:4.5.1-1",
"4:4.5.1-2",
"4:4.5.1-3",
"4:4.5.2-1",
"4:4.5.2-2",
"4:4.5.3.1-1",
"4:4.5.4-1",
"4:4.5.4.1-2",
"4:4.5.4.1-2ubuntu1",
"4:4.5.4.1-2ubuntu2",
"4:4.5.4.1-2ubuntu2.1",
"4:4.5.4.1-2ubuntu2.1+esm2",
"4:4.5.4.1-2ubuntu2.1+esm3",
"4:4.5.4.1-2ubuntu2.1+esm4",
"4:4.5.4.1-2ubuntu2.1+esm5",
"4:4.5.4.1-2ubuntu2.1+esm6"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "phpmyadmin",
"binary_version": "4:4.6.6-5ubuntu0.5"
}
]
},
"package": {
"ecosystem": "Ubuntu:18.04:LTS",
"name": "phpmyadmin",
"purl": "pkg:deb/ubuntu/phpmyadmin@4:4.6.6-5ubuntu0.5?arch=source\u0026distro=bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4:4.6.6-5ubuntu0.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4:4.6.6-5"
]
}
],
"aliases": [],
"details": "In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.",
"id": "UBUNTU-CVE-2020-10803",
"modified": "2025-09-08T16:46:03Z",
"published": "2020-03-22T05:15:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2020-10803"
},
{
"type": "REPORT",
"url": "https://www.phpmyadmin.net/security/PMASA-2020-4/"
},
{
"type": "REPORT",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/46a7aa7cd4ff2be0eeb23721fbf71567bebe69a5"
},
{
"type": "REPORT",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/6b9b2601d8af916659cde8aefd3a6eaadd10284a"
},
{
"type": "REPORT",
"url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-4639-1"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10803"
}
],
"related": [
"USN-4639-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2020-10803"
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…