GitHub Advisoryadvisory · Packagist

GHSA-5pmg-qh2c-7j24 phpMyAdmin allows remote attackers to spoof content via the url parameter

HIGH Published 2022-05-17 Modified 2025-04-14 Official page ↗
Aliases
CVE-2015-7873
Ecosystem
Packagist
Packages
phpmyadmin/phpmyadmin
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-20, CWE-79
Reviewed
2025-04-14

Affected packages

• Packagist phpmyadmin/phpmyadmin: >= 4.4.0, < 4.4.15.1 → fixed in 4.4.15.1 • Packagist phpmyadmin/phpmyadmin: >= 4.5.0, < 4.5.1 → fixed in 4.5.1

Description

The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.

Related

Alias · CVE (1)

  • CVE-2015-7873 The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References