GitHub Advisoryadvisory · Packagist

GHSA-r3pq-mp8v-cp33 phpMyAdmin Multiple Cross-site Scripting Vulnerabilities in the Database Structure page

LOW Published 2022-05-17 Modified 2023-08-29 Official page ↗
Aliases
CVE-2012-4345
Ecosystem
Packagist
Packages
phpmyadmin/phpmyadmin
Severity
Low
Weaknesses
CWE-79
Reviewed
2023-08-29

Affected packages

• Packagist phpmyadmin/phpmyadmin: >= 3.4, < 3.4.11.1 → fixed in 3.4.11.1 • Packagist phpmyadmin/phpmyadmin: >= 3.5, < 3.5.2.2 → fixed in 3.5.2.2

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.

Related

Alias · CVE (1)

  • CVE-2012-4345 Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References