CVE-2016-5730

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving 1 an array value to FormDisplay.php, 2 incorrect data to validate.php, 3 unexpected data to Validator.php, 4 a missing config directory...

CVE-2016-5732

Multiple cross-site scripting XSS vulnerabilities in the partition-range implementation in templates/table/structure/displaypartitions.phtml in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via crafted table parameters...

CVE-2016-5734

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the pregreplace e aka eval modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table...

CVE-2016-5732

Multiple cross-site scripting XSS vulnerabilities in the partition-range implementation in templates/table/structure/displaypartitions.phtml in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via crafted table parameters...

CVE-2016-5706

js/getscripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service via a large array in the scripts parameter...

CVE-2016-5739

CVE-2016-5739 affects phpMyAdmin: Transformation feature vulnerability in 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3. Root cause is omission of no-referrer CSP, enabling CSRF token leakage via Referer header. Impact: potential exposure/read of authentication token enabl...

CVE-2016-5705

CVE-2016-5705 affects phpMyAdmin 4.4.x < 4.4.15.7 and 4.6.x

CVE-2016-5702

CVE-2016-5702 affects phpMyAdmin 4.6.x prior to 4.6.3. The vulnerability arises when the environment lacks PHP_SELF, enabling cookie-attribute injection via a crafted URI. Affected component is the web management interface; the root cause is missing PHP_SELF handling that allows manipulation of c...

CVE-2016-5701

setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to conduct BBCode injection attacks against HTTP sessions via a crafted URI...

CVE-2016-5704

Cross-site scripting XSS vulnerability in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving a comment...

CVE-2016-5733

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 a crafted table name that is mishandled during privilege checking in...

CVE-2016-5703

phpMyAdmin is affected: versions 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 contain an SQL injection in libraries/central_columns.lib.php caused by improper sanitization of the database name in central column queries. This allows remote attackers to execute arbitrary SQL commands. Remediation: ...

CVE-2016-5739

The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy CSP protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication toke...

CVE-2016-5731

Cross-site scripting XSS vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message...

CVE-2016-5702

phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHPSELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI...

CVE-2016-5730

Summary : CVE-2016-5730 affects phpMyAdmin 4.0.x prior to 4.0.10.16, 4.4.x prior to 4.4.15.7, and 4.6.x prior to 4.6.3. It enables information disclosure by causing error messages to reveal the full installation path via several vectors: (1) an array value to FormDisplay.php, (2) invalid data to ...

CVE-2016-5731

CVE-2016-5731 is a cross‑site scripting (XSS) vulnerability in the phpMyAdmin OpenID authentication flow. The issue affects phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3, where an OpenID error message can be manipulated to inject arbitrary web script or HTML via...

CVE-2016-5701

CVE-2016-5701 affects phpMyAdmin; BBCode injection can be triggered in HTTP sessions via a crafted URI in setup/frames/index.inc.php. Affected versions include 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3. Debian notes the vulnerability among phpMyAdmin fixes and, i...

CVE-2016-5733

CVE-2016-5733 describes multiple XSS vulnerabilities in phpMyAdmin across 4.0.x < 4.0.10.16, 4.4.x < 4.4.15.7, and 4.6.x

CVE-2016-5704

CVE-2016-5704 affects phpMyAdmin 4.6.x before 4.6.3. The vulnerability is a cross-site scripting (XSS) in the table-structure page, exploitable via vectors involving a table comment. Impact: attacker can inject arbitrary script/HTML into a user’s browser session. Remediation: upgrade to phpMyAdmi...