CVE-2014-5273
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x...
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php.
- Record
CVE-2014-5273- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php.
- Record
CVE-2014-5273- Updated
- 2026-11-02
EUVDEUVD-2014-5166 No score
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php.
- Record
EUVD-2014-5166- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qjm2-f85j-5793 No score
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x...
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php.
- Record
GHSA-qjm2-f85j-5793- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php.
- Record
CVE-2014-5273- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-5273 No score
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php.
- Record
DEBIAN-CVE-2014-5273- Updated
- 2026-11-02
OSVMGASA-2014-0344 No score
Updated phpmyadmin package fixes XSS vulnerabilities
Updated phpmyadmin package fixes security vulnerabilities:
In phpMyAdmin before 4.1.14.3, multiple XSS vulnerabilities exist in browse table, ENUM editor, monitor, query charts and table relations pages (CVE-2014-5273).
In phpMyAdmin before 4.1.14.3, with a crafted view name it is possible to trigger an XSS when dropping the view in view operation page (CVE-2014-5274).
- Record
MGASA-2014-0344- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10054-1 No score
phpMyAdmin-4.6.5.2-1.1 on GA media
These are all security issues fixed in the phpMyAdmin-4.6.5.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10054-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-5273 No score
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php.
- Record
UBUNTU-CVE-2014-5273- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmyadminDebian:12 |
before 4:4.2.7.1-1 | 4:4.2.7.1-1 |
phpmyadminDebian:13 |
before 4:4.2.7.1-1 | 4:4.2.7.1-1 |
phpmyadminDebian:14 |
before 4:4.2.7.1-1 | 4:4.2.7.1-1 |
phpmyadminMageia:3 From an advisory covering 2 CVEs |
before 4.1.14.3-1.mga3 | 4.1.14.3-1.mga3 |
phpmyadminMageia:4 From an advisory covering 2 CVEs |
before 4.1.14.3-1.mga4 | 4.1.14.3-1.mga4 |
phpmyadminUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 4:4.0.6-14:4.0.8-14:4.0.9-14:4.0.10-14:4.0.10-1ubuntu0.1 Show 4 moreShow less4:4.0.10-1ubuntu0.1+esm14:4.0.10-1ubuntu0.1+esm24:4.0.10-1ubuntu0.1+esm34:4.0.10-1ubuntu0.1+esm4 |
None known |
phpMyAdminopenSUSE:Tumbleweed From an advisory covering 124 CVEs |
before 4.6.5.2-1.1 | 4.6.5.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-5273 is a low vulnerability (CVSS 3.5) in Phpmyadmin, published August 21, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.71%, the 77th percentile. Fixed in phpmyadmin 4:4.2.7.1-1.
References
lists.opensuse.org/opensuse-updates/2014-08/msg00045.html
github.com/phpmyadmin/phpmyadmin/commit/647c9d12e33a6b64e1c3ff7487f72696bdf2dccb
phpmyadmin.net/home_page/security/PMASA-2014-8.php
Show 134 moreShow less
secunia.com/advisories/60397
nvd.nist.gov/vuln/detail/CVE-2014-5273
security-tracker.debian.org/tracker/CVE-2014-5273
advisories.mageia.org/MGASA-2014-0344.html
bugs.mageia.org/show_bug.cgi?id=13935
ubuntu.com/security/CVE-2014-5273
cve.org/CVERecord?id=CVE-2014-5273
suse.com/security/cve/CVE-2011-4107