CVE-2012-5368
phpMyAdmin Unsafe Fetching of Javascript Code
phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
Exploit likelihood
What each source reports
NVD Score used
phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
- Record
CVE-2012-5368- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
- Record
CVE-2012-5368- Updated
- 2026-11-02
EUVDEUVD-2022-5839 No score
phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
- Record
EUVD-2022-5839- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xpxp-v33m-5jp9 No score
phpMyAdmin Unsafe Fetching of Javascript Code
phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
- Record
GHSA-xpxp-v33m-5jp9- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-xpxp-v33m-5jp9 No score
phpMyAdmin Unsafe Fetching of Javascript Code
phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
- Record
GHSA-xpxp-v33m-5jp9- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10054-1 No score
phpMyAdmin-4.6.5.2-1.1 on GA media
These are all security issues fixed in the phpMyAdmin-4.6.5.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10054-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmyadmin/phpmyadminPackagist |
3.5 up to 3.5.3 | 3.5.3 |
phpMyAdminopenSUSE:Tumbleweed |
before 4.6.5.2-1.1 | 4.6.5.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-5368 is a medium vulnerability (CVSS 4.3) in Phpmyadmin, published October 25, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.35%, the 71st percentile. Fixed in phpmyadmin/phpmyadmin 3.5.3.
References
phpmyadmin.net/home_page/security/PMASA-2012-7.php
github.com/phpmyadmin/phpmyadmin/commit/a547f3d3e2cf36c6a904fa3e053fd8bddd3fbbb0
lists.opensuse.org/opensuse-updates/2012-11/msg00033.html
securityfocus.com/bid/55939
nvd.nist.gov/vuln/detail/CVE-2012-5368
Show 126 moreShow less
web.archive.org/web/20200228143700/http://www.securityfocus.com/bid/55939
suse.com/security/cve/CVE-2011-4107