Every CVE Search/ Get API key

CVE-2015-6830

phpMyAdmin ReCaptcha bypass

5.0 MediumPublic exploitFix available

libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.

Exploit likelihood

10.4%Up 9.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.

Record
CVE-2015-6830
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.

Record
CVE-2015-6830
Updated
2026-11-02
EUVDEUVD-2022-5294 No score

libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.

Record
EUVD-2022-5294
Updated
2026-11-03
GitHub AdvisoriesGHSA-v6fh-vg22-r6cm No score

phpMyAdmin ReCaptcha bypass

libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.

Record
GHSA-v6fh-vg22-r6cm
Weakness
CWE-200
Updated
2026-11-02
OSV No score

libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.

Record
CVE-2015-6830
Updated
2026-11-02
OSVDEBIAN-CVE-2015-6830 No score

libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.

Record
DEBIAN-CVE-2015-6830
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-v6fh-vg22-r6cm No score

phpMyAdmin ReCaptcha bypass

libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.

Record
GHSA-v6fh-vg22-r6cm
Weakness
CWE-200
Updated
2026-11-02
OSVMGASA-2015-0366 No score

Updated phpmyadmin packages fix CVE-2015-6830

Updated phpmyadmin package fixes security vulnerability:

In phpMyAdmin before 4.3.13.2 and 4.4.14.1, installations with reCaptcha enabled allow completing the reCaptcha test and subsequently performing a brute force attack to guess user credentials without having to complete further reCaptcha tests (CVE-2015-6830).

Record
MGASA-2015-0366
Updated
2026-11-02
OSVopenSUSE-SU-2024:10054-1 No score

phpMyAdmin-4.6.5.2-1.1 on GA media

These are all security issues fixed in the phpMyAdmin-4.6.5.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10054-1
Updated
2026-11-02
OSVUBUNTU-CVE-2015-6830 No score

libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.

Record
UBUNTU-CVE-2015-6830
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
phpmyadmin/phpmyadmin
Packagist
 4.3.0 up to 4.3.13.2
4.3.13.2
phpmyadmin/phpmyadmin
Packagist
 4.4.0 up to 4.4.14.1
4.4.14.1
phpmyadmin
Debian:12
 before 4:4.4.14.1-1
4:4.4.14.1-1
phpmyadmin
Debian:13
 before 4:4.4.14.1-1
4:4.4.14.1-1
phpmyadmin
Debian:14
 before 4:4.4.14.1-1
4:4.4.14.1-1
phpmyadmin
Debian:7
From an advisory covering 7 CVEs
 before 4:3.4.11.1-2+deb7u2, plus listed versions
4:3.4.11.1-24:3.4.11.1-2+deb7u1
4:3.4.11.1-2+deb7u2
phpmyadmin
Debian:8
From an advisory covering 7 CVEs
 before 4:4.2.12-2+deb8u1, plus listed versions
4:4.2.12-2
4:4.2.12-2+deb8u1
phpmyadmin
Mageia:4
 before 4.2.13.3-1.1.mga4
4.2.13.3-1.1.mga4
phpmyadmin
Mageia:5
 before 4.2.13.3-1.1.mga5
4.2.13.3-1.1.mga5
phpMyAdmin
openSUSE:Tumbleweed
From an advisory covering 124 CVEs
 before 4.6.5.2-1.1
4.6.5.2-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBPHPMyAdmin 3.0 - Bruteforce Login Bypass2025-08-18

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-6830 is a medium vulnerability (CVSS 5.0) in Phpmyadmin, published September 13, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.4%, the 95th percentile. Fixed in phpmyadmin/phpmyadmin 4.3.13.2.

References

Show 136 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open