CVE-2015-7873
phpMyAdmin allows remote attackers to spoof content via the url parameter
The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
Exploit likelihood
What each source reports
NVD Score used
The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
- Record
CVE-2015-7873- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-254
- Updated
- 2026-11-02
CVE List No score
The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
- Record
CVE-2015-7873- Updated
- 2026-11-02
EUVDEUVD-2015-7771 No score
The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
- Record
EUVD-2015-7771- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5pmg-qh2c-7j24
phpMyAdmin allows remote attackers to spoof content via the url parameter
The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
- Record
GHSA-5pmg-qh2c-7j24- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-20, CWE-79
- Updated
- 2026-11-02
OSVGHSA-5pmg-qh2c-7j24
phpMyAdmin allows remote attackers to spoof content via the url parameter
The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
- Record
GHSA-5pmg-qh2c-7j24- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-20, CWE-79
- Updated
- 2026-11-02
OSV No score
The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
- Record
CVE-2015-7873- Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2015-7873 No score
The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
- Record
DEBIAN-CVE-2015-7873- Updated
- 2026-11-02
OSVMGASA-2015-0419 No score
Updated phpmyadmin package fixes security vulnerability
Content spoofing vulnerability when redirecting user to an external site (CVE-2015-7873).
- Record
MGASA-2015-0419- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10054-1 No score
phpMyAdmin-4.6.5.2-1.1 on GA media
These are all security issues fixed in the phpMyAdmin-4.6.5.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10054-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-7873 No score
The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
- Record
UBUNTU-CVE-2015-7873- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmyadmin/phpmyadminPackagist |
4.4.0 up to 4.4.15.1 | 4.4.15.1 |
phpmyadmin/phpmyadminPackagist |
4.5.0 up to 4.5.1 | 4.5.1 |
phpmyadminDebian:12 |
before 4:4.5.1-1 | 4:4.5.1-1 |
phpmyadminDebian:13 |
before 4:4.5.1-1 | 4:4.5.1-1 |
phpmyadminDebian:14 |
before 4:4.5.1-1 | 4:4.5.1-1 |
phpmyadminDebian:7 From an advisory covering 7 CVEs |
before 4:3.4.11.1-2+deb7u2, plus listed versions 4:3.4.11.1-24:3.4.11.1-2+deb7u1 |
4:3.4.11.1-2+deb7u2 |
phpmyadminDebian:8 From an advisory covering 7 CVEs |
before 4:4.2.12-2+deb8u1, plus listed versions 4:4.2.12-2 |
4:4.2.12-2+deb8u1 |
phpmyadminMageia:5 |
before 4.2.13.3-1.2.mga5 | 4.2.13.3-1.2.mga5 |
phpMyAdminopenSUSE:Tumbleweed From an advisory covering 124 CVEs |
before 4.6.5.2-1.1 | 4.6.5.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-7873 is a medium vulnerability (CVSS 5.0) in Phpmyadmin, published October 28, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.62%, the 85th percentile. Fixed in phpmyadmin/phpmyadmin 4.4.15.1.
References
github.com/phpmyadmin/phpmyadmin/commit/cd097656758f981f80fb9029c7d6b4294582b706
phpmyadmin.net/security/PMASA-2015-5
debian.org/security/2015/dsa-3382
lists.fedoraproject.org/pipermail/package-announce/2015-November/171326.html
securitytracker.com/id/1034013
Show 137 moreShow less
securityfocus.com/bid/77299
nvd.nist.gov/vuln/detail/CVE-2015-7873
web.archive.org/web/20161014120907/http://www.securitytracker.com/id/1034013
security-tracker.debian.org/tracker/CVE-2015-7873
advisories.mageia.org/MGASA-2015-0419.html
bugs.mageia.org/show_bug.cgi?id=17044
ubuntu.com/security/CVE-2015-7873
cve.org/CVERecord?id=CVE-2015-7873
suse.com/security/cve/CVE-2011-4107