Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
324 results · page 1 of 7
Oct 5, 2026A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12.CVE-2026-105392 · Other software · Lybbn · reported by VulDBMedium 5.5
A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key . Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project maintainer explains: "The issue with this key is described in the documentation. Developers need to manually change their keys before deployment."
- Product
- Django-Vue-Lyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026EasyAdmin is a fast and modern admin generator for Symfony applications.CVE-2026-54087 · Other software · EasyCorp · reported by GitHubHigh 7.6
EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or Content-Disposition attachment header. When uploads are stored under the public web root, an attacker with access to an affected form can upload HTML through FileField or SVG through ImageField, and JavaScript executes in an authenticated administrator's origin when the file is opened from the backend. Exploitation requires a privilege gap between the uploader and viewer. The issue can expose session or CSRF tokens and enable privilege escalation, but does not permit PHP or PHTML code execution because Symfony guessExtension does not produce those stored extensions. This issue is fixed in version 5.0.13.
- Product
- EasyAdminBundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attCVE-2026-50894 · Other software · reported by MITRECritical 9.8
easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026EasyAdmin is a fast and modern admin generator for Symfony applications.CVE-2026-81892 · Other software · EasyCorp · reported by GitHubHigh 8.1
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1.
- Product
- EasyAdminBundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/sCVE-2026-37149 · Other software · reported by MITREHigh 7.7
GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins.CVE-2020-37116 · Websites & servers · reported by VulnCheckHigh 8.7
GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins. Attackers with access to the platform can remotely access phpMyAdmin and, after uploading a shell, view the config.php file to obtain the MySQL password, leading to full database compromise.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.openeclass.orgexploit-db.com
Jan 23, 2025An issue was discovered in phpMyAdmin 5.x before 5.2.2.CVE-2025-24530 · Websites & servers · phpMyAdmin · reported by MITREMedium 6.4
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS.
- Product
- phpMyAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphpmyadmin.netlists.debian.org
Jan 23, 2025An issue was discovered in phpMyAdmin 5.x before 5.2.2.CVE-2025-24529 · Websites & servers · phpMyAdmin · reported by MITREMedium 6.4
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the Insert tab.
- Product
- phpMyAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphpmyadmin.netlists.debian.org
Dec 16, 2024CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php.CVE-2024-56112 · Other software · Cyberpanel · reported by MITREMedium 6.1
CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php.
- Product
- Cyberpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberpanel.netgithub.com
Nov 13, 2024In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permission check.CVE-2024-40661 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Aug 29, 2024bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/getContent.phpCVE-2024-41351 · Other software · baijunyao · reported by MITREMedium 6.1
bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/getContent.php
- Product
- thinkphp-bjyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/imageUp.phpCVE-2024-41350 · Other software · baijunyao · reported by MITREMedium 6.1
bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/imageUp.php
- Product
- thinkphp-bjyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2024A vulnerability classified as problematic has been found in lakernote EasyAdmin up to 20240324.CVE-2024-5383 · Other software · lakernote · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in lakernote EasyAdmin up to 20240324. This affects an unknown part of the file /sys/file/upload. The manipulation of the argument file leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 9c8a836ace17a93c45e5ad52a2340788b7795030. It is recommended to apply a patch to fix this issue. The identifier VDB-266301 was assigned to this vulnerability.
- Product
- EasyAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2024A vulnerability was found in EasyCorp EasyAdmin up to 4.8.9.CVE-2024-3081 · Other software · EasyCorp · reported by VulDBLow 3.5
A vulnerability was found in EasyCorp EasyAdmin up to 4.8.9. It has been declared as problematic. Affected by this vulnerability is the function Autocomplete of the file assets/js/autocomplete.js of the component Autocomplete. The manipulation of the argument item leads to cross site scripting. The attack can be launched remotely. Upgrading to version 4.8.10 is able to address this issue. The identifier of the patch is 127436e4c3f56276d548070f99e61b7234200a11. It is recommended to upgrade the affected component. The identifier VDB-258613 was assigned to this vulnerability.
- Product
- EasyAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability, which was classified as critical, was found in lakernote EasyAdmin up to 20240315.CVE-2024-2828 · Other software · lakernote · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in lakernote EasyAdmin up to 20240315. Affected is the function thumbnail of the file src/main/java/com/laker/admin/module/sys/controller/IndexController.java. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 23165d8cb569048c531150f194fea39f8800b8d5. It is recommended to apply a patch to fix this issue. VDB-257718 is the identifier assigned to this vulnerability.
- Product
- EasyAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability, which was classified as critical, has been found in lakernote EasyAdmin up to 20240315.CVE-2024-2827 · Other software · lakernote · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in lakernote EasyAdmin up to 20240315. This issue affects some unknown processing of the file /ureport/designer/saveReportFile. The manipulation leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257717 was assigned to this vulnerability.
- Product
- EasyAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315.CVE-2024-2826 · Other software · lakernote · reported by VulDBMedium 6.3
A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the file /ureport/designer/saveReportFile. The manipulation leads to xml external entity reference. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257716.
- Product
- EasyAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability classified as critical has been found in lakernote EasyAdmin up to 20240315.CVE-2024-2825 · Other software · lakernote · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in lakernote EasyAdmin up to 20240315. This affects an unknown part of the file /ureport/designer/saveReportFile. The manipulation of the argument file leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257715.
- Product
- EasyAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2023File Upload vulnerability in Wolf-leo EasyAdmin8 v.1.0 allows a remote attacker to execute arbtirary code via the upload type function.CVE-2023-38915 · Other software · Wolf18 · reported by MITRECritical 9.8
File Upload vulnerability in Wolf-leo EasyAdmin8 v.1.0 allows a remote attacker to execute arbtirary code via the upload type function.
- Product
- Easyadmin8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability was found in EasyAdmin8 2.0.2.2.CVE-2023-3800 · Other software · Wolfcode · reported by VulDBLow 3.9
A vulnerability was found in EasyAdmin8 2.0.2.2. It has been classified as problematic. Affected is an unknown function of the file /admin/index/index.html#/admin/mall.goods/index.html of the component File Upload Module. The manipulation leads to unrestricted upload. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235068. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Easyadmin8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2023onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Member List module.CVE-2023-26951 · Other software · Onekeyadmin · reported by MITREMedium 5.4
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Member List module.
- Product
- Onekeyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins.CVE-2023-26957 · Other software · Onekeyadmin · reported by MITRECritical 9.1
onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins.
- Product
- Onekeyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/file/download.CVE-2023-26948 · Other software · Onekeyadmin · reported by MITREHigh 7.5
onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/file/download.
- Product
- Onekeyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code.CVE-2023-26956 · Other software · Onekeyadmin · reported by MITREHigh 7.5
onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code.
- Product
- Onekeyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Menu module.CVE-2023-26952 · Other software · Onekeyadmin · reported by MITREMedium 5.4
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Menu module.
- Product
- Onekeyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Title parameter under the Adding Categories module.CVE-2023-26950 · Other software · Onekeyadmin · reported by MITREMedium 5.4
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Title parameter under the Adding Categories module.
- Product
- Onekeyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Administrator module.CVE-2023-26953 · Other software · Onekeyadmin · reported by MITREMedium 4.8
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Administrator module.
- Product
- Onekeyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Admin Group module.CVE-2023-26955 · Other software · Onekeyadmin Project · reported by MITREMedium 5.4
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Admin Group module.
- Product
- Onekeyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Group module.CVE-2023-26954 · Other software · Onekeyadmin Project · reported by MITREMedium 5.4
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Group module.
- Product
- Onekeyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows attackers to execute arbitrary code via a crafted PHPCVE-2023-26949 · Other software · Onekeyadmin · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Onekeyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.CVE-2023-25727 · Websites & servers · Phpmyadmin · reported by MITREMedium 5.4
In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.
- Product
- Phpmyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphpmyadmin.netlists.debian.org
Jan 27, 2023LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /index.php/surveyAdministration/rendersidemenuliCVE-2022-48010 · Other software · Limesurvey · reported by MITREMedium 5.4
LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /index.php/surveyAdministration/rendersidemenulink?subaction=surveytexts. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Welcome-message text fields. NOTE: the vendor indicates that this is not a vulnerability because the manipulation requires Superadministrator privileges, and Superadministrators are already allowed to customize surveys with JavaScript as they wish.
- Product
- Limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation pCVE-2020-22452 · Websites & servers · reported by MITRECritical 9.8
SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022WP phpMyAdmin: Does not escape some of its settingsCVE-2022-2407 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP phpMyAdmin WordPress plugin before 5.2.0.4 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP phpMyAdmin
- Fixed in
- 5.2.0.4
- What to do
- Update WP phpMyAdmin to 5.2.0.4 or newer.
Jun 30, 2022MyAdmin v1.0 is affected by an incorrect access control vulnerability in viewing personal center in /api/user/userData?userCode=admin.CVE-2021-37791 · Other software · Myadmin Project · reported by MITREMedium 4.9
MyAdmin v1.0 is affected by an incorrect access control vulnerability in viewing personal center in /api/user/userData?userCode=admin.
- Product
- Myadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2022The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumCVE-2021-43954 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.3
The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.
- Product
- Fisheye
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.atlassian.comjira.atlassian.com
Mar 10, 2022PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests.CVE-2022-0813 · Websites & servers · phpMyAdmin · reported by cve-coordination@incibe.esMedium 5.3
PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.
- Product
- phpMyAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgincibe-cert.es
Jan 21, 2022An issue was discovered in phpMyAdmin 5.1 before 5.1.2.CVE-2022-23808 · Websites & servers · Phpmyadmin · reported by MITREMedium 6.1
An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.
- Product
- Phpmyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinfosecwriteups.comsecurity.gentoo.org
Jan 21, 2022An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2.CVE-2022-23807 · Websites & servers · Phpmyadmin · reported by MITREMedium 4.3
An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.
- Product
- Phpmyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgphpmyadmin.net
Jul 30, 2021ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string.CVE-2020-26563 · Other software · Objectplanet · reported by MITREMedium 6.1
ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. (There is also stored XSS if input to survey/admin/*.do is accepted from untrusted users.)
- Product
- Opinio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comobjectplanet.com
Feb 10, 2021An information disclosure issue exists in henriquedornas 5.2.17 because an attacker can dump phpMyAdmin SQL content.CVE-2021-26939 · Other software · Henriquedornas · reported by MITREHigh 7.5
An information disclosure issue exists in henriquedornas 5.2.17 because an attacker can dump phpMyAdmin SQL content. NOTE: third parties report that this is a site-specific problem
- Product
- Henriquedornas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.opensuse.orggithub.com
Nov 4, 2020phpMyAdmin through 5.0.2 allows CSV injection via Export Section.CVE-2020-22278 · Websites & servers · Phpmyadmin · reported by MITREHigh 8.8
phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because "the CSV file is accurately generated based on the database contents.
- Product
- Phpmyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.ikiu.ac.irmega.nz
Oct 10, 2020An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3.CVE-2020-26935 · Websites & servers · Phpmyadmin · reported by MITRECritical 9.8
An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.
- Product
- Phpmyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Oct 10, 2020phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.CVE-2020-26934 · Websites & servers · Phpmyadmin · reported by MITREMedium 6.1
phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.
- Product
- Phpmyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Mar 31, 2020phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error pagCVE-2020-11441 · Websites & servers · Phpmyadmin · reported by MITREMedium 6.1
phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states "I don't see anything specifically exploitable.
- Product
- Phpmyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2020In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack thCVE-2020-10803 · Websites & servers · Phpmyadmin · reported by MITREMedium 5.4
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.
- Product
- Phpmyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Mar 22, 2020In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when geCVE-2020-10802 · Websites & servers · Phpmyadmin · reported by MITREHigh 8
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.
- Product
- Phpmyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Mar 22, 2020In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/PCVE-2020-10804 · Websites & servers · Phpmyadmin · reported by MITREHigh 8
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its privileges).
- Product
- Phpmyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Feb 18, 2020WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass VulnerabilitiesCVE-2013-4454 · WordPress plugins & themes · reported by Red HatCritical 9.1
WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass Vulnerabilities
- Affected
- 1.4.1 to 1.4.1
- What to do
- Affects 1.4.1 to 1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jan 27, 2020WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerabilityCVE-2013-4462 · WordPress plugins & themes · reported by Red HatCritical 9.1
WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.