Skip to content
Noroxi

phpMyAdmin records

277 published records for vendor phpMyAdmin. 1 of them have been exploited in the wild (listed in CISA KEV) and 6 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
1 · 0.4%
Weaponized
6 · 2.2%
Pre-auth RCE
22
With a fix record
92.8%
Median publish → KEV
4747 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 16
  2. 17
  3. 18
  4. 19
  5. 20
  6. 22
  7. 23
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

277 records
  • CVE-2009-1151
    98Now

    Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inje

    CriticalCVSS 9.8KEVWeaponizedEPSS 96%

    phpmyadmin · phpmyadminMar 26, 2009

  • CVE-2018-12613
    65This week

    An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the serve

    HighCVSS 8.8WeaponizedEPSS 98%

    phpmyadmin · phpmyadminJun 21, 2018

  • CVE-2016-5734
    63This week

    phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the p

    CriticalCVSS 9.8WeaponizedEPSS 80%

    phpmyadmin · phpmyadminJul 2, 2016

  • CVE-2020-26935
    58Plan

    An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3.

    CriticalCVSS 9.8Proof of conceptEPSS 63%

    phpmyadmin · phpmyadminOct 10, 2020

  • CVE-2012-5159
    52Plan

    phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced

    HighCVSS 7.5WeaponizedEPSS 74%

    phpmyadmin · phpmyadminSep 25, 2012

  • CVE-2020-5504
    43Plan

    In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page.

    HighCVSS 8.8Proof of conceptEPSS 28%

    phpmyadmin · phpmyadminJan 9, 2020

  • CVE-2004-1147
    43Plan

    phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary c

    CriticalCVSS 10.0Proof of conceptEPSS 11%

    phpmyadmin · phpmyadminJan 10, 2005

  • CVE-2008-7252
    41Plan

    libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 uses predictable filenames for temporary files, which has unknown impact and at

    CriticalCVSS 10.0No exploitEPSS 2%

    phpmyadmin · phpmyadminJan 19, 2010

  • CVE-2008-7251
    41Plan

    libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 creates a temporary directory with 0777 permissions, which has unknown impact a

    CriticalCVSS 10.0No exploitEPSS 2%

    phpmyadmin · phpmyadminJan 19, 2010

  • CVE-2007-0203
    41Plan

    Multiple unspecified vulnerabilities in phpMyAdmin before 2.9.2-rc1 have unknown impact and attack vectors.

    CriticalCVSS 10.0No exploitEPSS 1%

    phpmyadmin · phpmyadminJan 11, 2007

  • CVE-2013-3238
    40Plan

    phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, wh

    MediumCVSS 6.0WeaponizedEPSS 28%

    phpmyadmin · phpmyadminApr 25, 2013

  • CVE-2009-1285
    40Plan

    Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows

    HighCVSS 7.5WeaponizedEPSS 10%

    phpmyadmin · phpmyadminApr 16, 2009

  • CVE-2019-6798
    40Plan

    An issue was discovered in phpMyAdmin before 4.8.5.

    CriticalCVSS 9.8No exploitEPSS 3%

    phpmyadmin · phpmyadminJan 26, 2019

  • CVE-2019-11768
    40Plan

    An issue was discovered in phpMyAdmin before 4.9.0.1.

    CriticalCVSS 9.8No exploitEPSS 3%

    phpmyadmin · phpmyadminJun 5, 2019

  • CVE-2016-6629
    40Plan

    An issue was discovered in phpMyAdmin involving the $cfg['ArbitraryServerRegexp'] configuration directive.

    CriticalCVSS 9.8No exploitEPSS 3%

    phpmyadmin · phpmyadminDec 10, 2016

  • CVE-2016-6620
    40Plan

    An issue was discovered in phpMyAdmin.

    CriticalCVSS 9.8No exploitEPSS 3%

    phpmyadmin · phpmyadminDec 10, 2016

  • CVE-2017-18264
    40Plan

    An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases.

    CriticalCVSS 9.8No exploitEPSS 2%

    phpmyadmin · phpmyadminMay 1, 2018

  • CVE-2016-9849
    40Plan

    An issue was discovered in phpMyAdmin.

    CriticalCVSS 9.8No exploitEPSS 2%

    phpmyadmin · phpmyadminDec 10, 2016

  • CVE-2016-5703
    40Plan

    SQL injection vulnerability in libraries/central_columns.lib.php in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote at

    CriticalCVSS 9.8No exploitEPSS 2%

    phpmyadmin · phpmyadminJul 2, 2016

  • CVE-2019-19617
    40Plan

    phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/

    CriticalCVSS 9.8No exploitEPSS 2%

    phpmyadmin · phpmyadminDec 5, 2019

  • CVE-2016-9865
    40Plan

    An issue was discovered in phpMyAdmin.

    CriticalCVSS 9.8No exploitEPSS 2%

    phpmyadmin · phpmyadminDec 10, 2016

  • CVE-2019-18622
    40Plan

    An issue was discovered in phpMyAdmin before 4.9.2.

    CriticalCVSS 9.8No exploitEPSS 2%

    phpmyadmin · phpmyadminNov 22, 2019

  • CVE-2020-22452
    40Plan

    SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engin

    CriticalCVSS 9.8No exploitEPSS 1%

    phpmyadmin · phpmyadminJan 26, 2023

  • CVE-2016-9866
    39Monitor

    An issue was discovered in phpMyAdmin.

    CriticalCVSS 9.8No exploitEPSS 1%

    phpmyadmin · phpmyadminDec 10, 2016

  • CVE-2017-1000499
    38Monitor

    phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness.

    HighCVSS 8.8Proof of conceptEPSS 8%

    phpmyadmin · phpmyadminJan 3, 2018