CVE-2016-9859

An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in import feature. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are affected...

CVE-2016-6631

CVE-2016-6631 describes a remote code execution issue in phpMyAdmin when run as CGI. Under certain server configurations, a user can pass a query string that is executed as a command-line argument by the file generator_plugin.sh, enabling RCE on the server. Affected versions are all 4.6.x before ...

CVE-2016-6627

An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

CVE-2016-6616

CVE-2016-6616 affects phpMyAdmin: in the User group and Designer features, an attacker can perform an SQL injection against the control user’s account. Affected are all 4.6.x versions before 4.6.4 and 4.4.x versions before 4.4.15.8. This is a server-side issue within phpMyAdmin’s web interface, a...

CVE-2016-6633

An issue was discovered in phpMyAdmin. phpMyAdmin can be used to trigger a remote code execution attack against certain PHP installations that are running with the dbase extension. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are...

CVE-2016-9865

CVE-2016-9865 affects phpMyAdmin due to a bug in serialized string parsing that can bypass PMA_safeUnserialize(). Affected versions: 4.6.x before 4.6.5; 4.4.x before 4.4.15.9; 4.0.x before 4.0.10.18. Remediations are available in the corresponding fixed releases: 4.6.5, 4.4.15.9, 4.0.10.18. Metri...

CVE-2016-6633

CVE-2016-6633 affects phpMyAdmin: remote code execution possible on PHP installations using the dbase extension. Affected: phpMyAdmin 4.0.x before 4.0.10.17, 4.4.x before 4.4.15.8, and 4.6.x before 4.6.4. Connected sources confirm this vulnerability and document remediation guidance. Impact is re...

CVE-2016-6611

CVE-2016-6611 affects phpMyAdmin across multiple branches: 4.0.x before 4.0.10.17, 4.4.x before 4.4.15.8, and 4.6.x before 4.6.4. The issue is an SQL injection triggered via the export functionality when a specially crafted database/table name is used. Impact details are described in the connecte...

CVE-2016-9847

The CVE-2016-9847 issue affects phpMyAdmin, where not specifying a blowfish_secret for cookie encryption causes a runtime-generated value that uses a weak algorithm. Affected are phpMyAdmin releases: 4.6.x before 4.6.5, 4.4.x before 4.4.15.9, and 4.0.x before 4.0.10.18. The weak construction coul...

CVE-2016-9866

phpMyAdmin is affected by CVE-2016-9866 due to improper handling of the CSRF token in return URLs for the preference import action when arg_separator differs from its default value. Affected versions include 4.6.x prior to 4.6.5, 4.4.x prior to 4.4.15.9, and 4.0.x prior to 4.0.10.18. Evidence in ...

CVE-2016-6628

The CVE-2016-6628 issue affects phpMyAdmin and allows an attacker to cause a user to download a specially crafted SVG file. Affected branches include 4.6.x before 4.6.4, 4.4.x before 4.4.15.8, and 4.0.x before 4.0.10.17. Connected advisories and trackers confirm the vulnerability exists in phpMyA...

CVE-2016-9857

phpMyAdmin has a cross-site scripting (XSS) vulnerability (CVE-2016-9857) caused by a weakness in a JavaScript processing regex. Affected releases: 4.6.x before 4.6.5, 4.4.x before 4.4.15.9, and 4.0.x before 4.0.10.18. Remediation: upgrade to a fixed version (e.g., 4.6.5.1 or later). If upgrading...

CVE-2016-6613

An issue was discovered in phpMyAdmin. A user can specially craft a symlink on disk, to a file which phpMyAdmin is permitted to read but the user is not, which phpMyAdmin will then expose to the user. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to...

CVE-2016-9864

An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and ...

CVE-2016-6609

CVE-2016-6609 affects phpMyAdmin; a specially crafted database name could cause arbitrary PHP commands to be executed via the array export feature. Affected versions: all 4.6.x before 4.6.4, all 4.4.x before 4.4.15.8, and all 4.0.x before 4.0.10.17. Remediation is upgrade to the fixed releases (4...

CVE-2016-9860

CVE-2016-9860 describes a DoS in phpMyAdmin when $cfg['AllowArbitraryServer']=true. Affected are phpMyAdmin 4.6.x before 4.6.5, 4.4.x before 4.4.15.9, and 4.0.x before 4.0.10.18. Root cause is unauthenticated DoS via arbitrary servers; impact is availability. Remediation per connected sources: up...

CVE-2016-6627

CVE-2016-6627 affects phpMyAdmin, exposing host location via the file url.php. All 4.6.x versions before 4.6.4, all 4.4.x before 4.4.15.8, and all 4.0.x before 4.0.10.17 are vulnerable. The issue is a information disclosure flaw in how url.php reveals the phpMyAdmin host, enabling an attacker to ...

CVE-2016-9854

Summary (CVE-2016-9854) : A path disclosure issue in phpMyAdmin arises when triggering certain scripts; an error message can reveal the full path to the phpMyAdmin installation, and during export time these paths are written into the export file. Affected versions are all 4.6.x before 4.6.5 and 4...

CVE-2016-6610

CVE-2016-6610 is a full path disclosure vulnerability in phpMyAdmin. A crafted error in the export mechanism can reveal the full installation path on disk. Affected are phpMyAdmin 4.6.x prior to 4.6.4, 4.4.x prior to 4.4.15.8, and 4.0.x prior to 4.0.10.17. The flaw enables an attacker to infer th...

CVE-2016-9856

CVE-2016-9856 is a PHPMyAdmin XSS issue tied to an earlier fix for CVE-2016-2559 (PMASA-2016-10). The vulnerability affects 4.6.x (before 4.6.5), 4.4.x (before 4.4.15.9), and 4.0.x (before 4.0.10.18) due to reuse of a hash in a race condition; remediation is to upgrade to fixed versions (e.g., 4....