CVE-2016-5702

phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHPSELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI...

CVE-2016-5734: Improper Control of Generation of Code

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the pregreplace e aka eval modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table...

CVE-2016-5731: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message...

CVE-2016-5706: Undefined Security Weakness

js/getscripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service via a large array in the scripts parameter...

CVE-2016-5703: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in libraries/centralcolumns.lib.php in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query...

CVE-2016-5739: Exposure of Sensitive Information to an Unauthorized Actor

The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy CSP protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication toke...

CVE-2016-5704: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving a comment...

CVE-2016-5705: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 server-privileges certificate data fields on the user privileges page, 2 an "invalid JSON" error messa...

PT-2016-6653

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.4.x through 4.4.15.6 phpMyAdmin versions 4.6.x through 4.6.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via several vectors, including server-privileges certificate data fields on...

PT-2016-6650

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.6.x before 4.6.3 Description The issue allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI when the environment lacks a PHP SELF value. Recommendations For phpMyAdmin versions 4.6.x...

CVE-2016-5701: Improper Neutralization of Special Elements in Output Used by a Downstream Component

setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to conduct BBCode injection attacks against HTTP sessions via a crafted URI...

CVE-2016-5733: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 a crafted table name that is mishandled during privilege checking in...

CVE-2016-5730: Exposure of Sensitive Information to an Unauthorized Actor

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving 1 an array value to FormDisplay.php, 2 incorrect data to validate.php, 3 unexpected data to Validator.php, 4 a missing config directory...

CVE-2016-5732: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the partition-range implementation in templates/table/structure/displaypartitions.phtml in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via crafted table parameters...

PT-2016-6652

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.6.x before 4.6.3 Description The issue is related to a cross-site scripting XSS vulnerability in the table-structure page. This allows remote attackers to inject arbitrary web script or HTML via vectors involving a commen...

PT-2016-6662

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.6.0 through 4.6.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via crafted table parameters in the partition-range implementation in the table-structure page. This is due to multipl...

PT-2016-6651

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.4.x through 4.4.15.6 phpMyAdmin versions 4.6.x through 4.6.2 Description The issue allows remote attackers to execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query. This...

CVE-2016-5702: Undefined Security Weakness

phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHPSELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI...

phpMyAdmin Cross-Site Request Forgery Vulnerability

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. There is a security vulnerability in phpMyAdmin. An...

phpMyAdmin cross-site scripting vulnerability (CNVD-2016-04396)

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A cross-site scripting vulnerability exists in...