CVE-2025-24530
phpMyAdmin XSS when checking tables
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS.
- Record
CVE-2025-24530- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-0114
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS.
- Record
EUVD-2025-0114- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-222v-cx2c-q2f5
phpMyAdmin XSS when checking tables
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS.
- Record
GHSA-222v-cx2c-q2f5- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS.
- Record
CVE-2025-24530- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-24530
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS.
- Record
DEBIAN-CVE-2025-24530- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-222v-cx2c-q2f5
phpMyAdmin XSS when checking tables
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS.
- Record
GHSA-222v-cx2c-q2f5- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2025-24530
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS.
- Record
UBUNTU-CVE-2025-24530- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVBIT-phpmyadmin-2025-24530 No score
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS.
- Record
BIT-phpmyadmin-2025-24530- Updated
- 2026-11-02
OSV No score
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS.
- Record
CVE-2025-24530- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:0081-1 No score
Security update for phpMyAdmin
This update for phpMyAdmin fixes the following issues:
Update to version 5.2.2:
- CVE-2025-24530: XSS in the 'Check Tables' feature (bsc#1236312).
- CVE-2025-24529: XSS in the 'Insert' tab (bsc#1236311).
- CVE-2024-2961: glibc/iconv: out-of-bounds writes when writing escape sequences (bsc#1222992).
- CVE-2023-30536: slim/psr7: improper header validation (bsc#1238159).
- Record
openSUSE-SU-2025:0081-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14846-1 No score
phpMyAdmin-5.2.2-2.1 on GA media
These are all security issues fixed in the phpMyAdmin-5.2.2-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14846-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmyadmin/phpmyadminPackagist |
5.0.0 up to 5.2.2 | 5.2.2 |
phpmyadminBitnami |
5.0.0 up to 5.2.2 | 5.2.2 |
phpmyadminDebian:12 |
before 4:5.2.1+dfsg-1+deb12u1, plus listed versions 4:5.2.1+dfsg-1 |
4:5.2.1+dfsg-1+deb12u1 |
phpmyadminDebian:13 |
before 4:5.2.2-really5.2.2+20250121+dfsg-1 | 4:5.2.2-really5.2.2+20250121+dfsg-1 |
phpmyadminDebian:14 |
before 4:5.2.2-really5.2.2+20250121+dfsg-1 | 4:5.2.2-really5.2.2+20250121+dfsg-1 |
phpmyadminDebian:11 From an advisory covering 3 CVEs |
before 4:5.0.4+dfsg2-2+deb11u2, plus listed versions 4:5.0.4+dfsg2-24:5.0.4+dfsg2-2+deb11u1 |
4:5.0.4+dfsg2-2+deb11u2 |
phpmyadmin/phpmyadminPackagist |
5.0.0 up to 5.2.2, plus listed versions 5.0.0.15.0.15.0.25.0.35.0.4 Show 7 moreShow less5.1.05.1.15.1.25.1.35.1.45.2.05.2.1 |
5.2.2 |
phpmyadminUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 4:4.0.6-14:4.0.8-14:4.0.9-14:4.0.10-14:4.0.10-1ubuntu0.1 Show 4 moreShow less4:4.0.10-1ubuntu0.1+esm14:4.0.10-1ubuntu0.1+esm24:4.0.10-1ubuntu0.1+esm34:4.0.10-1ubuntu0.1+esm4 |
None known |
phpmyadminUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 4:4.4.13.1-14:4.5.0.2-24:4.5.1-14:4.5.1-24:4.5.1-3 Show 13 moreShow less4:4.5.2-14:4.5.2-24:4.5.3.1-14:4.5.4-14:4.5.4.1-24:4.5.4.1-2ubuntu14:4.5.4.1-2ubuntu24:4.5.4.1-2ubuntu2.14:4.5.4.1-2ubuntu2.1+esm24:4.5.4.1-2ubuntu2.1+esm34:4.5.4.1-2ubuntu2.1+esm44:4.5.4.1-2ubuntu2.1+esm54:4.5.4.1-2ubuntu2.1+esm6 |
None known |
phpmyadminUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4:4.6.6-54:4.6.6-5ubuntu0.2+esm14:4.6.6-5ubuntu0.2+esm24:4.6.6-5ubuntu0.54:4.6.6-5ubuntu0.5+esm1 |
None known |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
phpmyadminUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4:4.9.1+dfsg1-24:4.9.2+dfsg1-14:4.9.5+dfsg1-1ubuntu14:4.9.5+dfsg1-24:4.9.5+dfsg1-2ubuntu0.1~esm1 |
None known |
phpmyadminUbuntu:22.04:LTS |
All versions, plus listed versions 4:5.0.4+dfsg2-2ubuntu54:5.1.1+dfsg1-5ubuntu1 |
None known |
phpmyadminUbuntu:24.04:LTS |
All versions, plus listed versions 4:5.2.1+dfsg-1ubuntu14:5.2.1+dfsg-2ubuntu14:5.2.1+dfsg-2ubuntu24:5.2.1+dfsg-3 |
None known |
phpmyadminUbuntu:25.10 |
All versions, plus listed versions 4:5.2.2-really5.2.2+20250121+dfsg-14:5.2.2-really+dfsg-14:5.2.2-really+dfsg-2 |
None known |
phpmyadminUbuntu:26.10 |
All versions, plus listed versions 4:5.2.3+dfsg-14:5.2.4~dev~git20260809.e0909b211b+dfsg-1 |
None known |
phpmyadminUbuntu:26.04:LTS |
All versions, plus listed versions 4:5.2.2-really+dfsg-24:5.2.3+dfsg-1 |
None known |
phpMyAdminSUSE:Package Hub 15 SP6 From an advisory covering 4 CVEs |
before 5.2.2-bp156.4.3.1 | 5.2.2-bp156.4.3.1 |
phpMyAdminopenSUSE:Leap 15.6 From an advisory covering 4 CVEs |
before 5.2.2-bp156.4.3.1 | 5.2.2-bp156.4.3.1 |
phpMyAdminopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 5.2.2-2.1 | 5.2.2-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-24530 is a medium vulnerability (CVSS 6.4) in Phpmyadmin, published January 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in phpmyadmin/phpmyadmin 5.2.2.
References
phpmyadmin.net/security/PMASA-2025-1
lists.debian.org/debian-lts-announce/2025/04/msg00016.html
nvd.nist.gov/vuln/detail/CVE-2025-24530
github.com/phpmyadmin/phpmyadmin/commit/23c13a81709728089ff031e5b1c29b5e91baa6a7
security-tracker.debian.org/tracker/CVE-2025-24530
Show 12 moreShow less
ubuntu.com/security/CVE-2025-24530
cve.org/CVERecord?id=CVE-2025-24530
lists.opensuse.org/archives/list/[email protected]/thread/472PX6IZ26ALBE66YKBJD3XTN7M34U4L
bugzilla.suse.com/1222992
suse.com/security/cve/CVE-2023-30536