{"id":"CVE-2014-8958","aliases":["DEBIAN-CVE-2014-8958","DLA-336-1","DSA-3382-1","EUVD-2014-8785","GHSA-rpvm-cpgc-m3w7","MGASA-2014-0495","UBUNTU-CVE-2014-8958","openSUSE-SU-2024:10054-1"],"status":"published","title":"Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x...","description":"Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02441,"percentile":0.84411,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2014-11-26T17:29:06Z","modified":"2026-10-23T15:47:28Z","fixes":[{"ecosystem":"Debian:12","package":"phpmyadmin","fixed_in":["4:4.2.12-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"phpmyadmin","fixed_in":["4:4.2.12-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"phpmyadmin","fixed_in":["4:4.2.12-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.2.12-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.2.12-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.2.12-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:3.3.7-9"}]}],"versions":["4:3.3.7-3","4:3.3.7-5","4:3.3.7-6","4:3.3.7-7","4:3.3.7-8"],"bundled":4},{"source":"osv","ecosystem":"Debian:7","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:3.4.11.1-2+deb7u2"}]}],"versions":["4:3.4.11.1-2","4:3.4.11.1-2+deb7u1"],"bundled":7},{"source":"osv","ecosystem":"Debian:8","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.2.12-2+deb8u1"}]}],"versions":["4:4.2.12-2"],"bundled":7},{"source":"osv","ecosystem":"Mageia:3","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.14.7-1.mga3"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:4","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.14.7-1.mga4"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.0.6-1","4:4.0.8-1","4:4.0.9-1","4:4.0.10-1","4:4.0.10-1ubuntu0.1","4:4.0.10-1ubuntu0.1+esm1","4:4.0.10-1ubuntu0.1+esm2","4:4.0.10-1ubuntu0.1+esm3","4:4.0.10-1ubuntu0.1+esm4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.5.2-1.1"}]}],"bundled":124}],"products":[{"vendor":"phpmyadmin","product":"phpmyadmin"}],"references":[{"url":"https://security.gentoo.org/glsa/201505-03","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/d32da348c4de2379482a48661ce968a55eebe5c4","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.debian.org/security/2015/dsa-3382","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web","report"]},{"url":"http://www.securityfocus.com/bid/71243","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/2ffdbf2d7daa0b92541d8b754e2afac555d3ed21","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/2a3b7393d1d5a8ba0543699df94a08a0f5728fe0","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:228","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/1bc04ec95038f2356ad33752090001bf1c047208","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8958"},{"url":"https://github.com/advisories/GHSA-rpvm-cpgc-m3w7"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-8958","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0495.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14637","tags":["report"]},{"url":"http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php","tags":["web"]},{"url":"http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php","tags":["web"]},{"url":"http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-8958","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8958","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5734","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9866","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-8958","description":"Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.","status":"published","published":"2014-11-30T11:00:00Z","modified":"2024-08-06T13:33:12.66Z","updated_at":"2026-11-02T14:33:43.206348Z"}],"euvd":[{"id":"EUVD-2014-8785","description":"Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.","status":"published","published":"2014-11-30T11:00:00Z","modified":"2024-08-06T13:33:12Z","updated_at":"2026-11-03T01:56:50.592563Z"}],"ghsa":[{"id":"GHSA-rpvm-cpgc-m3w7","title":"Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x...","description":"Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.","status":"published","published":"2022-05-17T03:20:55Z","modified":"2023-01-27T05:08:00Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:43:13.955662Z"}],"nvd":[{"id":"CVE-2014-8958","description":"Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.","status":"published","published":"2014-11-30T11:59:00.087Z","modified":"2026-06-17T00:17:35.073Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"CVE-2014-8958","description":"Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.","status":"published","published":"2014-11-30T11:59:00Z","modified":"2026-04-16T06:21:59.146096696Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-8958","description":"Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.","status":"published","published":"2014-11-30T11:59:00.087Z","modified":"2026-10-23T15:47:28.959326017Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"DLA-336-1","title":"phpmyadmin - security update","status":"published","published":"2015-10-28T00:00:00Z","modified":"2026-03-09T01:19:19.100899Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-3382-1","title":"phpmyadmin - security update","status":"published","published":"2015-10-28T00:00:00Z","modified":"2026-03-09T01:19:13.884871Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2014-0495","title":"Updated phpmyadmin packages fix security vulnerabilities","description":"Updated phpmyadmin package fixes security vulnerabilities:\n\nIn phpMyAdmin before 4.1.14.7, with a crafted database, table or column name\nit is possible to trigger an XSS attack in the table browse page, with a\ncrafted ENUM value it is possible to trigger XSS attacks in the table print\nview and zoom search pages, and with a crafted value for font size it is\npossible to trigger an XSS attack in the home page (CVE-2014-8958).\n\nIn phpMyAdmin before 4.1.14.7, in the GIS editor feature, a parameter\nspecifying the geometry type was not correcly validated, opening the door to\na local file inclusion attack (CVE-2014-8959).\n\nIn phpMyAdmin before 4.1.14.7, with a crafted file name it is possible to\ntrigger an XSS in the error reporting page (CVE-2014-8960).\n\nIn phpMyAdmin before 4.1.14.7, in the error reporting feature, a parameter\nspecifying the file was not correctly validated, allowing the attacker to\nderive the line count of an arbitrary file (CVE-2014-8961).\n","status":"published","published":"2014-11-26T17:29:06Z","modified":"2026-04-16T06:25:56.194774462Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10054-1","title":"phpMyAdmin-4.6.5.2-1.1 on GA media","description":"These are all security issues fixed in the phpMyAdmin-4.6.5.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:07:59.433224Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"UBUNTU-CVE-2014-8958","description":"Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.","status":"published","published":"2014-11-30T11:59:00Z","modified":"2025-09-08T16:43:15Z","updated_at":"2026-11-02T15:54:09.378953Z"}]}}