CVE-2016-5734-docker

CVE-2016-5734-docker PhpMyAdmin 4.0.x—4.6.2 Remote Code Execution Vulnerability CVE-2016-5734 Setup git clone https://github.com/miko550/CVE-2016-5734-docker.git cd CVE-2016-5734-docker docker compose up hhtp://localhost:8083 exploit python3 cve-2016-5734.py -u root --pwd="root"...

CVE-2018-12613

CVE-2018-12613 Modified standalone exploit ported to Python 3. Tested on Python 3.7.3, phpMyAdmin 4.8.1 running on Ubuntu 16.04 Works on Linux only. Original exploit by SSD. All credits to them. Changes made 1. Added function to exit if provided phpMyAdmin username/password is correct 2. Added...

CVE-2018-12613-phpMyAdmin

CVE-2018-12613-phpMyAdmin This article will share a file inclusion vulnerability in phpMyAdmin version 4.8.1, explaining from configuration to principle, and then to vulnerability reproduction. More importantly, it helps everyone understand the knowledge behind these real vulnerabilities. A basic...

phpmyadmin-csrf-sql

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · phpmyadmin-csrf-sql Write-up: https://abraxaslabs.tech/research/phpmyadmin-csrf-sql phpmyadmin-csrf-sql Class: CSRF Reach: Remote phpMyAdmin 5.2.3 tag RELEASE523, commit 962857e. Common.php builds the PSR-7 request fr...

phpMyAdmin-CVE-2020-5504-Exploit

CVE-2020-5504 phpMyAdmin Security Assessment Tool Authorized security testing and research framework for identifying and validating CVE-2020-5504 in phpMyAdmin deployments Overview · Features · Installation · Usage · Reports · Architecture · Contributing Responsible-use notice: This project is...

phpmyadmin-config-set-2fa

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · phpmyadmin-config-set-2fa Write-up: https://abraxaslabs.tech/research/phpmyadmin-config-set-2fa phpmyadmin-config-set-2fa Class: Privilege leftover / missing step-up Reach: Remote phpMyAdmin 5.2.3 RELEASE523 / 962857e...

phpmyadmin-auth-plugin-unquoted

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · phpmyadmin-auth-plugin-unquoted Write-up: https://abraxaslabs.tech/research/phpmyadmin-auth-plugin-unquoted phpmyadmin-auth-plugin-unquoted Class: SQLi Reach: Remote phpMyAdmin 5.2.3 RELEASE523 / 962857e - phpMyAdmin...

phpmyadmin-webauthn

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · phpmyadmin-webauthn Write-up: https://abraxaslabs.tech/research/phpmyadmin-webauthn phpmyadmin-webauthn Class: 2FA bypass Reach: Remote phpMyAdmin 5.2.3 tag RELEASE523. Default tarball. web-auth/webauthn-lib is sugges...

phpmyadmin-issuperuser

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · phpmyadmin-issuperuser Write-up: https://abraxaslabs.tech/research/phpmyadmin-issuperuser phpmyadmin-issuperuser Class: Privilege leftover Reach: Remote phpMyAdmin 5.2.3 RELEASE523 / 962857e - phpMyAdmin...

FreeBSD : phpMyAdmin -- Multiple vulnerabilities, no fix available (e6b90d23-d49d-11f1-bae2-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e6b90d23-d49d-11f1-bae2-3497f65b111b advisory. VulnCheck reports: Seven vulnerabilities in phpMyAdmin up to and including 5.2.3 were publishe...

CVE-2026-119428

A flaw was found in phpMyAdmin. This Server-Side Request Forgery SSRF vulnerability allows an unauthenticated remote attacker to trigger outbound network connections by submitting custom host and port values to the setup validation script. By inspecting the returned connection error messages, an...

CVE-2026-119561

A flaw was found in phpMyAdmin. This issue allows a remote attacker with valid database credentials to bypass two-factor authentication 2FA. The application fails to verify Web Authentication WebAuthn cryptographic assertion signatures against stored public keys during login. An attacker can...

CVE-2026-119563

A flaw was found in phpMyAdmin. This stored cross-site scripting XSS vulnerability allows an authenticated database user with table creation privileges to execute arbitrary script in another user's browser session. By creating a database table with a name containing malicious markup, the unescape...

CVE-2026-119562

A flaw was found in phpMyAdmin. An authenticated user can exploit a Structured Query Language SQL injection vulnerability by submitting unescaped parameters to the central columns interface. Because these inputs are processed into database queries executed with elevated control user privileges, a...

CVE-2026-119427

A flaw was found in phpMyAdmin. An authenticated remote attacker can exploit a Structured Query Language SQL injection vulnerability in the Designer component by submitting crafted parameters when saving configuration settings. This issue allows the attacker to execute unintended database queries...

CVE-2026-119429

A flaw was found in phpMyAdmin. An authenticated remote attacker can disable two-factor authentication 2FA on an account by submitting a configuration update request without being prompted for password re-verification. An attacker with access to an active session can exploit this issue to remove...

CVE-2026-119426

A flaw was found in phpMyAdmin. A remote attacker can execute arbitrary database queries by bypassing cross-site request forgery CSRF token validation on standard HTTP POST requests. By tricking an authenticated user into submitting a crafted cross-site request, an attacker can execute SQL comman...

CVE-2026-119561

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthnrequestresponse with...

CVE-2026-119562

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute values to /database/central-columns. Attackers can inject SQL into pmacentralcolumns INSERT and UPDATE queries run with controluser...

DEBIAN-CVE-2026-119562

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute values to /database/central-columns. Attackers can inject SQL into pmacentralcolumns INSERT and UPDATE queries run with controluser...