CVE-2014-4349
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x...
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action.
- Record
CVE-2014-4349- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action.
- Record
CVE-2014-4349- Updated
- 2026-11-02
EUVDEUVD-2014-4276 No score
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action.
- Record
EUVD-2014-4276- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-47r4-gvw9-7fw7 No score
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x...
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action.
- Record
GHSA-47r4-gvw9-7fw7- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action.
- Record
CVE-2014-4349- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-4349 No score
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action.
- Record
DEBIAN-CVE-2014-4349- Updated
- 2026-11-02
OSVMGASA-2014-0275 No score
Updated phpmyadmin packages fix CVE-2014-4349
Updated phpmyadmin packages fix security vulnerability:
In phpMyAdmin before 4.1.14, it is possible to trigger an XSS when hiding or unhiding a crafted table name in the navigation, due to unescaped HTML output in the navigation items hiding feature. Note that this vulnerability can only be triggered by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form (CVE-2014-4349).
- Record
MGASA-2014-0275- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10054-1 No score
phpMyAdmin-4.6.5.2-1.1 on GA media
These are all security issues fixed in the phpMyAdmin-4.6.5.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10054-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmyadminDebian:12 |
before 4:4.2.5-1 | 4:4.2.5-1 |
phpmyadminDebian:13 |
before 4:4.2.5-1 | 4:4.2.5-1 |
phpmyadminDebian:14 |
before 4:4.2.5-1 | 4:4.2.5-1 |
phpmyadminMageia:3 |
before 4.1.14.1-1.mga3 | 4.1.14.1-1.mga3 |
phpmyadminMageia:4 |
before 4.1.14.1-1.mga4 | 4.1.14.1-1.mga4 |
phpMyAdminopenSUSE:Tumbleweed From an advisory covering 124 CVEs |
before 4.6.5.2-1.1 | 4.6.5.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-4349 is a low vulnerability (CVSS 3.5) in Phpmyadmin, published June 25, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.15%, the 82nd percentile. Fixed in phpmyadmin 4:4.2.5-1.
References
lists.opensuse.org/opensuse-updates/2014-08/msg00045.html
github.com/phpmyadmin/phpmyadmin/commit/daa98d0c7ed24b529dc5df0d5905873acd0b00be
phpmyadmin.net/home_page/security/PMASA-2014-3.php
securityfocus.com/bid/68205
secunia.com/advisories/60397
Show 129 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-4349
security-tracker.debian.org/tracker/CVE-2014-4349
advisories.mageia.org/MGASA-2014-0275.html
bugs.mageia.org/show_bug.cgi?id=13573
suse.com/security/cve/CVE-2011-4107