CVE-2012-4345
phpMyAdmin Multiple Cross-site Scripting Vulnerabilities in the Database Structure page
CVE-2012-4345 is a low vulnerability (CVSS 3.5) in Phpmyadmin, published August 21, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.45%, the 73rd percentile. Fixed in phpmyadmin/phpmyadmin 3.4.11.1.
- Severity
- 3.5 LowCVSS 2.0, NVD
- Exploit chance
- 1.45%EPSS, 73rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.4.11.1phpmyadmin/phpmyadmin +5 more
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmyadmin/phpmyadminPackagist | 3.4 up to 3.4.11.1 | 3.4.11.1 |
phpmyadmin/phpmyadminPackagist | 3.5 up to 3.5.2.2 | 3.5.2.2 |
phpmyadminDebian:12 | before 4:3.4.11.1-1 | 4:3.4.11.1-1 |
phpmyadminDebian:13 | before 4:3.4.11.1-1 | 4:3.4.11.1-1 |
phpmyadminDebian:14 | before 4:3.4.11.1-1 | 4:3.4.11.1-1 |
phpMyAdminopenSUSE:Tumbleweed From an advisory covering 124 CVEs | before 4.6.5.2-1.1 | 4.6.5.2-1.1 |
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
- Record
CVE-2012-4345- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
- Record
CVE-2012-4345- Updated
- 2026-11-02
EUVDEUVD-2022-5081No score
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
- Record
EUVD-2022-5081- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r3pq-mp8v-cp33No score
phpMyAdmin Multiple Cross-site Scripting Vulnerabilities in the Database Structure page
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
- Record
GHSA-r3pq-mp8v-cp33- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
- Record
CVE-2012-4345- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-4345No score
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
- Record
DEBIAN-CVE-2012-4345- Updated
- 2026-11-02
OSVGHSA-r3pq-mp8v-cp33No score
phpMyAdmin Multiple Cross-site Scripting Vulnerabilities in the Database Structure page
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
- Record
GHSA-r3pq-mp8v-cp33- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10054-1No score
phpMyAdmin-4.6.5.2-1.1 on GA media
These are all security issues fixed in the phpMyAdmin-4.6.5.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10054-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
phpmyadmin.net/home_page/security/PMASA-2012-4.php
mandriva.com/security/advisories?name=MDVSA-2012:136
hermes.opensuse.org/messages/15513071
nvd.nist.gov/vuln/detail/CVE-2012-4345
web.archive.org/web/20150523055725/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2012:136?name=MDVSA-2012:136
github.com/advisories/GHSA-r3pq-mp8v-cp33
Show 125 moreShow less
security-tracker.debian.org/tracker/CVE-2012-4345
suse.com/security/cve/CVE-2011-4107