CVE-2012-4345
phpMyAdmin Multiple Cross-site Scripting Vulnerabilities in the Database Structure page
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
- Record
CVE-2012-4345- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
- Record
CVE-2012-4345- Updated
- 2026-11-02
EUVDEUVD-2022-5081 No score
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
- Record
EUVD-2022-5081- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r3pq-mp8v-cp33 No score
phpMyAdmin Multiple Cross-site Scripting Vulnerabilities in the Database Structure page
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
- Record
GHSA-r3pq-mp8v-cp33- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
- Record
CVE-2012-4345- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-4345 No score
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
- Record
DEBIAN-CVE-2012-4345- Updated
- 2026-11-02
OSVGHSA-r3pq-mp8v-cp33 No score
phpMyAdmin Multiple Cross-site Scripting Vulnerabilities in the Database Structure page
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
- Record
GHSA-r3pq-mp8v-cp33- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10054-1 No score
phpMyAdmin-4.6.5.2-1.1 on GA media
These are all security issues fixed in the phpMyAdmin-4.6.5.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10054-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmyadmin/phpmyadminPackagist |
3.4 up to 3.4.11.1 | 3.4.11.1 |
phpmyadmin/phpmyadminPackagist |
3.5 up to 3.5.2.2 | 3.5.2.2 |
phpmyadminDebian:12 |
before 4:3.4.11.1-1 | 4:3.4.11.1-1 |
phpmyadminDebian:13 |
before 4:3.4.11.1-1 | 4:3.4.11.1-1 |
phpmyadminDebian:14 |
before 4:3.4.11.1-1 | 4:3.4.11.1-1 |
phpMyAdminopenSUSE:Tumbleweed |
before 4.6.5.2-1.1 | 4.6.5.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-4345 is a low vulnerability (CVSS 3.5) in Phpmyadmin, published August 21, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.45%, the 73rd percentile. Fixed in phpmyadmin/phpmyadmin 3.4.11.1.
References
phpmyadmin.net/home_page/security/PMASA-2012-4.php
mandriva.com/security/advisories?name=MDVSA-2012:136
hermes.opensuse.org/messages/15513071
nvd.nist.gov/vuln/detail/CVE-2012-4345
web.archive.org/web/20150523055725/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2012:136?name=MDVSA-2012:136
github.com/advisories/GHSA-r3pq-mp8v-cp33
Show 125 moreShow less
security-tracker.debian.org/tracker/CVE-2012-4345
suse.com/security/cve/CVE-2011-4107