CVE-2018-19969

The CVE-2018-19969 entry concerns phpMyAdmin 4.7.x and 4.8.x prior to 4.8.4, which is affected by CSRF flaws. By luring a user to a crafted URL, an attacker can trigger harmful SQL operations (renaming databases, creating tables/routines, deleting pages, adding/removing users, updating passwords,...

CVE-2018-19969

phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users,...

CVE-2018-19969

phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users,...

CVE-2018-19970

In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name...

CVE-2018-19968

An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has...

CVE-2018-19969

phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users,...

CVE-2018-19970

In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name...

CVE-2018-19968

An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has...

CVE-2018-19970

Affected product: phpMyAdmin. Vulnerability: CVE-2018-19970 is a stored XSS in the navigation tree triggered by crafted database/table names in phpMyAdmin before version 4.8.4. Root cause: insufficient input handling in the navigation UI allows injecting script that can be executed in a user’s br...

phpMyAdmin Releases Critical Software Update — Patch Your Sites Now!

Developers of phpMyAdmin, one of the most popular and widely used MySQL database management systems, today released an updated version 4.8.4 of its software to patch several important vulnerabilities that could eventually allow remote attackers to take control of the affected web servers. The...

phpMyAdmin Releases Critical Software Update — Patch Your Sites Now!

Developers of phpMyAdmin, one of the most popular and widely used MySQL database management systems, today released an updated version 4.8.4 of its software to patch several important vulnerabilities that could eventually allow remote attackers to take control of the affected web servers. The...

CVE-2018-19970: Improper Neutralization of Input During Web Page Generation

In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name...

CVE-2018-19968: Exposure of Sensitive Information to an Unauthorized Actor

An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has...

CVE-2018-19969: Cross-Site Request Forgery (CSRF)

phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users,...

PT-2018-15179

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 4.8.4 Description A Cross-Site Scripting XSS issue was found in the navigation tree, allowing an attacker to deliver a payload to a user through a crafted database or table name. Recommendations For versions prior ...

PT-2018-15177

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 4.8.4 Description The issue allows an attacker to leak the contents of a local file due to an error in the transformation feature. To exploit this, the attacker must have access to the phpMyAdmin Configuration...

phpMyAdmin 4.7.x <= 4.7.6 / 4.8.x < 4.8.4 Multiple XSRF/CSRF Vulnerabilities (PMASA-2018-7)

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.7.x prior or equal to 4.7.6 or 4.8.x prior to 4.8.4. It is, therefore, affected by multiple cross-site request forgery XSRF vulnerabilities. A remote attacker can exploit this by trickin...

phpMyAdmin -- multiple vulnerabilities

The phpMyAdmin development team reports: Summary Local file inclusion through transformation feature Description A flaw has been found where an attacker can exploit phpMyAdmin to leak the contents of a local file. The attacker must have access to the phpMyAdmin Configuration Storage tables,...

WordPress HighStand 4.6.1 Database Disclosure

Exploit Title : WordPress HighStand Themes 4.6.1 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 08/12/2018 Vendor Homepage : wordpress.org Software Download Link :...

WordPress TimeTable Responsive Schedule 5.4 Database Disclosure

Exploit Title : WordPress TimeTable Responsive Schedule Plugins 5.4 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 08/12/2018 Vendor Homepage : wordpress.org codecanyon.net Software Download Link :...