CVEvulnerability

CVE-2006-6942

6.8 MEDIUM Published 2007-01-19 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2007-01-19
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in PhpMyAdmin before 2.9.1.1 allow remote attackers to inject arbitrary HTML or web script via (1) a comment for a table name, as exploited through (a) db_operations.php, (2) the db parameter to (b) db_create.php, (3) the newname parameter to db_operations.php, the (4) query_history_latest, (5) query_history_latest_db, and (6) querydisplay_tab parameters to (c) querywindow.php, and (7) the pos parameter to (d) sql.php.

Affected configurations

• phpmyadmin phpmyadmin (<= 2.9.1) • phpmyadmin phpmyadmin 2.9.0 • phpmyadmin phpmyadmin 2.9.0.1 • phpmyadmin phpmyadmin 2.9.0.2 • phpmyadmin phpmyadmin 2.9.0.3 • phpmyadmin phpmyadmin 2.9.0 beta1 • phpmyadmin phpmyadmin 2.9.0 rc1 • phpmyadmin phpmyadmin 2.9.1 rc1 • phpmyadmin phpmyadmin 2.9.1 rc2 • debian debian linux 3.1 • debian debian linux 4.0

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References