CVE-2016-9864

An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and ...

CVE-2016-6610

A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error in the export mechanism to discover the full path of phpMyAdmin on the disk. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are...

CVE-2016-6614

An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system. All 4.6.x versions prior...

CVE-2016-9853

An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the expo...

CVE-2016-9854

An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the expo...

CVE-2016-6610

CVE-2016-6610 is a full path disclosure vulnerability in phpMyAdmin. A crafted error in the export mechanism can reveal the full installation path on disk. Affected are phpMyAdmin 4.6.x prior to 4.6.4, 4.4.x prior to 4.4.15.8, and 4.0.x prior to 4.0.10.17. The flaw enables an attacker to infer th...

CVE-2016-9856

CVE-2016-9856 is a PHPMyAdmin XSS issue tied to an earlier fix for CVE-2016-2559 (PMASA-2016-10). The vulnerability affects 4.6.x (before 4.6.5), 4.4.x (before 4.4.15.9), and 4.0.x (before 4.0.10.18) due to reuse of a hash in a race condition; remediation is to upgrade to fixed versions (e.g., 4....

CVE-2016-6615

CVE-2016-6615 describes cross-site scripting (XSS) issues in phpMyAdmin. Affected areas include the navigation pane, database/table hiding feature, the Tracking feature, and the GIS visualization feature. All 4.6.x versions prior to 4.6.4 and 4.4.x versions prior to 4.4.15.8 are affected. The pro...

CVE-2016-9848

An issue was discovered in phpMyAdmin. phpinfo phpinfo.php shows PHP information including values of HttpOnly cookies. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are affected...

CVE-2016-6631

CVE-2016-6631 describes a remote code execution issue in phpMyAdmin when run as CGI. Under certain server configurations, a user can pass a query string that is executed as a command-line argument by the file generator_plugin.sh, enabling RCE on the server. Affected versions are all 4.6.x before ...

CVE-2016-6625

Summary: CVE-2016-6625 affects phpMyAdmin. An information-disclosure vulnerability allows an attacker to determine whether a user is logged in to phpMyAdmin. Affected versions are all 4.6.x before 4.6.4, 4.4.x before 4.4.15.8, and 4.0.x before 4.0.10.17. The disclosure does not expose the user’s ...

CVE-2016-9864

CVE-2016-9864 concerns phpMyAdmin with SQL injection in the tracking functionality via crafted usernames or table names, granting the control user’s privileges to read/write the configuration storage and potentially access some MySQL tables. Affected versions are all 4.6.x before 4.6.5, all 4.4.x...

CVE-2016-6611

CVE-2016-6611 affects phpMyAdmin across multiple branches: 4.0.x before 4.0.10.17, 4.4.x before 4.4.15.8, and 4.6.x before 4.6.4. The issue is an SQL injection triggered via the export functionality when a specially crafted database/table name is used. Impact details are described in the connecte...

CVE-2016-9852

An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the expo...

CVE-2016-9862

An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions prior to 4.6.5 are affected...

CVE-2016-6609

An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

CVE-2016-6611

An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

CVE-2016-6625

An issue was discovered in phpMyAdmin. An attacker can determine whether a user is logged in to phpMyAdmin. The user's session, username, and password are not compromised by this vulnerability. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to...

CVE-2016-6606

An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Furthermore, the same initialization vector...

CVE-2016-6611

An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...