Search Results (Refine Search)
- CPE Product Version: cpe:/a:phpmyadmin:phpmyadmin:3.5.7:rc1
Vuln ID | Summary | CVSS Severity |
---|---|---|
CVE-2014-1879 |
Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action. Published: February 20, 2014; 10:27:09 AM -0500 |
V3.x:(not available) V2.0: 3.5 LOW |
CVE-2013-5029 |
phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php. Published: August 19, 2013; 7:55:09 PM -0400 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
CVE-2013-5003 |
Multiple SQL injection vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote authenticated users to execute arbitrary SQL commands via (1) the scale parameter to pmd_pdf.php or (2) the pdf_page_number parameter to schema_export.php. Published: July 31, 2013; 9:20:08 AM -0400 |
V3.x:(not available) V2.0: 6.5 MEDIUM |
CVE-2013-5002 |
Cross-site scripting (XSS) vulnerability in libraries/schema/Export_Relation_Schema.class.php in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted pageNumber value to schema_export.php. Published: July 31, 2013; 9:20:08 AM -0400 |
V3.x:(not available) V2.0: 3.5 LOW |
CVE-2013-5000 |
phpMyAdmin 3.5.x before 3.5.8.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to config.default.php and other files. Published: July 31, 2013; 9:20:08 AM -0400 |
V3.x:(not available) V2.0: 5.0 MEDIUM |
CVE-2013-4998 |
phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to pmd_common.php and other files. Published: July 31, 2013; 9:20:08 AM -0400 |
V3.x:(not available) V2.0: 5.0 MEDIUM |
CVE-2013-4997 |
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in (1) an anchor identifier to setup/index.php or (2) a chartTitle (aka chart title) value. Published: July 31, 2013; 9:20:08 AM -0400 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
CVE-2013-4996 |
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted database name, (2) a crafted user name, (3) a crafted logo URL in the navigation panel, (4) a crafted entry in a certain proxy list, or (5) crafted content in a version.json file. Published: July 31, 2013; 9:20:08 AM -0400 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
CVE-2013-4995 |
Cross-site scripting (XSS) vulnerability in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SQL query that is not properly handled during the display of row information. Published: July 31, 2013; 9:20:08 AM -0400 |
V3.x:(not available) V2.0: 3.5 LOW |
CVE-2013-3239 |
phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename. Published: April 25, 2013; 11:34:23 PM -0400 |
V3.x:(not available) V2.0: 4.6 MEDIUM |
CVE-2013-3238 |
phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not properly handled before making a preg_replace function call within the "Replace table prefix" feature. Published: April 25, 2013; 11:34:23 PM -0400 |
V3.x:(not available) V2.0: 6.0 MEDIUM |
CVE-2013-1937 |
Multiple cross-site scripting (XSS) vulnerabilities in tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the (1) visualizationSettings[width] or (2) visualizationSettings[height] parameter. NOTE: a third party reports that this is "not exploitable. Published: April 16, 2013; 10:04:31 AM -0400 |
V3.0: 6.1 MEDIUM V2.0: 4.3 MEDIUM |