CVE-2014-8958
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x...
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
- Record
CVE-2014-8958- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
- Record
CVE-2014-8958- Updated
- 2026-11-02
EUVDEUVD-2014-8785 No score
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
- Record
EUVD-2014-8785- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rpvm-cpgc-m3w7 No score
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x...
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
- Record
GHSA-rpvm-cpgc-m3w7- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
- Record
CVE-2014-8958- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-8958 No score
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
- Record
DEBIAN-CVE-2014-8958- Updated
- 2026-11-02
OSVMGASA-2014-0495 No score
Updated phpmyadmin packages fix security vulnerabilities
Updated phpmyadmin package fixes security vulnerabilities:
In phpMyAdmin before 4.1.14.7, with a crafted database, table or column name it is possible to trigger an XSS attack in the table browse page, with a crafted ENUM value it is possible to trigger XSS attacks in the table print view and zoom search pages, and with a crafted value for font size it is possible to trigger an XSS attack in the home page (CVE-2014-8958).
In phpMyAdmin before 4.1.14.7, in the GIS editor feature, a parameter specifying the geometry type was not correcly validated, opening the door to a local file inclusion attack (CVE-2014-8959).
In phpMyAdmin before 4.1.14.7, with a crafted file name it is possible to trigger an XSS in the error reporting page (CVE-2014-8960).
In phpMyAdmin before 4.1.14.7, in the error reporting feature, a parameter specifying the file was not correctly validated, allowing the attacker to derive the line count of an arbitrary file (CVE-2014-8961).
- Record
MGASA-2014-0495- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10054-1 No score
phpMyAdmin-4.6.5.2-1.1 on GA media
These are all security issues fixed in the phpMyAdmin-4.6.5.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10054-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-8958 No score
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
- Record
UBUNTU-CVE-2014-8958- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmyadminDebian:12 |
before 4:4.2.12-1 | 4:4.2.12-1 |
phpmyadminDebian:13 |
before 4:4.2.12-1 | 4:4.2.12-1 |
phpmyadminDebian:14 |
before 4:4.2.12-1 | 4:4.2.12-1 |
phpmyadminDebian:6.0 From an advisory covering 4 CVEs |
before 4:3.3.7-9, plus listed versions 4:3.3.7-34:3.3.7-54:3.3.7-64:3.3.7-74:3.3.7-8 |
4:3.3.7-9 |
phpmyadminDebian:7 From an advisory covering 7 CVEs |
before 4:3.4.11.1-2+deb7u2, plus listed versions 4:3.4.11.1-24:3.4.11.1-2+deb7u1 |
4:3.4.11.1-2+deb7u2 |
phpmyadminDebian:8 From an advisory covering 7 CVEs |
before 4:4.2.12-2+deb8u1, plus listed versions 4:4.2.12-2 |
4:4.2.12-2+deb8u1 |
phpmyadminMageia:3 From an advisory covering 4 CVEs |
before 4.1.14.7-1.mga3 | 4.1.14.7-1.mga3 |
phpmyadminMageia:4 From an advisory covering 4 CVEs |
before 4.1.14.7-1.mga4 | 4.1.14.7-1.mga4 |
phpmyadminUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 4:4.0.6-14:4.0.8-14:4.0.9-14:4.0.10-14:4.0.10-1ubuntu0.1 Show 4 moreShow less4:4.0.10-1ubuntu0.1+esm14:4.0.10-1ubuntu0.1+esm24:4.0.10-1ubuntu0.1+esm34:4.0.10-1ubuntu0.1+esm4 |
None known |
phpMyAdminopenSUSE:Tumbleweed From an advisory covering 124 CVEs |
before 4.6.5.2-1.1 | 4.6.5.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-8958 is a medium vulnerability (CVSS 4.3) in Phpmyadmin, published November 26, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.44%, the 84th percentile. Fixed in phpmyadmin 4:4.2.12-1.
References
security.gentoo.org/glsa/201505-03
github.com/phpmyadmin/phpmyadmin/commit/d32da348c4de2379482a48661ce968a55eebe5c4
debian.org/security/2015/dsa-3382
lists.opensuse.org/opensuse-updates/2014-12/msg00017.html
phpmyadmin.net/home_page/security/PMASA-2014-13.php
securityfocus.com/bid/71243
Show 138 moreShow less
mandriva.com/security/advisories?name=MDVSA-2014:228
nvd.nist.gov/vuln/detail/CVE-2014-8958
security-tracker.debian.org/tracker/CVE-2014-8958
advisories.mageia.org/MGASA-2014-0495.html
bugs.mageia.org/show_bug.cgi?id=14637
ubuntu.com/security/CVE-2014-8958
cve.org/CVERecord?id=CVE-2014-8958
suse.com/security/cve/CVE-2011-4107