{"id":"CVE-2018-19968","aliases":["DEBIAN-CVE-2018-19968","DLA-1658-1","EUVD-2022-5764","GHSA-xc97-r49q-cxgc","MGASA-2018-0486","UBUNTU-CVE-2018-19968","USN-4639-1","USN-4843-1","openSUSE-SU-2024:11171-1"],"status":"published","title":"phpMyAdmin Local file inclusion through transformation feature","description":"An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02887,"percentile":0.86973,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2018-12-11T17:00:00Z","modified":"2026-10-24T10:30:56Z","fixes":[{"ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","fixed_in":["4.8.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"phpmyadmin","fixed_in":["4:4.9.1+dfsg1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"phpmyadmin","fixed_in":["4:4.9.1+dfsg1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"phpmyadmin","fixed_in":["4:4.9.1+dfsg1-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"phpmyadmin","fixed_in":["4:4.0.10-1ubuntu0.1+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"phpmyadmin","fixed_in":["4:4.5.4.1-2ubuntu2.1+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"phpmyadmin","fixed_in":["4:4.6.6-5ubuntu0.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.1+dfsg1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.1+dfsg1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.1+dfsg1-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.2.12-2+deb8u4"}]}],"versions":["4:4.2.12-2","4:4.2.12-2+deb8u1","4:4.2.12-2+deb8u2","4:4.2.12-2+deb8u3"],"bundled":2},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4"}]}],"versions":["4.0.0","4.0.1","4.0.10","4.0.10.1","4.0.10.2","4.0.10.3","4.0.10.4","4.0.10.5","4.0.10.6","4.0.10.7","4.0.10.8","4.0.10.9","4.0.2","4.0.3","4.0.4","4.0.4.1","4.0.4.2","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.7.0","4.7.1","4.7.2","4.7.3","4.7.4","4.7.5","4.7.6","4.7.7","4.7.8","4.7.9","4.8.0","4.8.0.1","4.8.1","4.8.2","4.8.3"]},{"source":"osv","ecosystem":"Mageia:6","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.8-3.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.0.10-1ubuntu0.1+esm4"}]}],"versions":["4:4.0.6-1","4:4.0.8-1","4:4.0.9-1","4:4.0.10-1","4:4.0.10-1ubuntu0.1","4:4.0.10-1ubuntu0.1+esm1","4:4.0.10-1ubuntu0.1+esm2","4:4.0.10-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.5.4.1-2ubuntu2.1+esm6"}]}],"versions":["4:4.4.13.1-1","4:4.5.0.2-2","4:4.5.1-1","4:4.5.1-2","4:4.5.1-3","4:4.5.2-1","4:4.5.2-2","4:4.5.3.1-1","4:4.5.4-1","4:4.5.4.1-2","4:4.5.4.1-2ubuntu1","4:4.5.4.1-2ubuntu2","4:4.5.4.1-2ubuntu2.1","4:4.5.4.1-2ubuntu2.1+esm2","4:4.5.4.1-2ubuntu2.1+esm3","4:4.5.4.1-2ubuntu2.1+esm4","4:4.5.4.1-2ubuntu2.1+esm5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.6.6-5ubuntu0.5"}]}],"versions":["4:4.6.6-5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.6.6-5ubuntu0.5"}]}],"versions":["4:4.6.6-5"],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.0.10-1ubuntu0.1+esm4"}]}],"versions":["4:4.0.6-1","4:4.0.8-1","4:4.0.9-1","4:4.0.10-1","4:4.0.10-1ubuntu0.1","4:4.0.10-1ubuntu0.1+esm1","4:4.0.10-1ubuntu0.1+esm2","4:4.0.10-1ubuntu0.1+esm3"],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.5.4.1-2ubuntu2.1+esm6"}]}],"versions":["4:4.4.13.1-1","4:4.5.0.2-2","4:4.5.1-1","4:4.5.1-2","4:4.5.1-3","4:4.5.2-1","4:4.5.2-2","4:4.5.3.1-1","4:4.5.4-1","4:4.5.4.1-2","4:4.5.4.1-2ubuntu1","4:4.5.4.1-2ubuntu2","4:4.5.4.1-2ubuntu2.1","4:4.5.4.1-2ubuntu2.1+esm2","4:4.5.4.1-2ubuntu2.1+esm3","4:4.5.4.1-2ubuntu2.1+esm4","4:4.5.4.1-2ubuntu2.1+esm5"],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.6.6-5ubuntu0.5+esm1"}]}],"versions":["4:4.6.6-5","4:4.6.6-5ubuntu0.2+esm1","4:4.6.6-5ubuntu0.2+esm2","4:4.6.6-5ubuntu0.5"],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.5+dfsg1-2ubuntu0.1~esm1"}]}],"versions":["4:4.9.1+dfsg1-2","4:4.9.2+dfsg1-1","4:4.9.5+dfsg1-1ubuntu1","4:4.9.5+dfsg1-2"],"bundled":21},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-1.2"}]}],"bundled":31}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"phpmyadmin","product":"phpmyadmin"}],"references":[{"url":"http://www.securityfocus.com/bid/106178","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2018-6/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/201904-16","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19968","tags":["advisory"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/6a1ba61e29002f0305a9322a8af4eaaeb11c0732","tags":["web","report"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2018-6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xc97-r49q-cxgc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-19968","tags":["advisory"]},{"url":"https://github.com/phpmyadmin/composer","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2018-0486.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24012","tags":["report"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2018-8/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-19968","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4639-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-19968","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4843-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-7260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6799","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11768","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12616","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-19617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-5504","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-26934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-26935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6609","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6619","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6630","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9866","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-18264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000015","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12581","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12922","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2005-2869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-2031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-5504","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-19968","description":"An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.","status":"published","published":"2018-12-11T17:00:00Z","modified":"2024-08-05T11:51:17.786Z","updated_at":"2026-11-02T14:35:02.966615Z"}],"euvd":[{"id":"EUVD-2022-5764","description":"An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.","status":"published","published":"2018-12-11T17:00:00Z","modified":"2024-08-05T11:51:17Z","updated_at":"2026-11-03T02:39:31.9745Z"}],"ghsa":[{"id":"GHSA-xc97-r49q-cxgc","title":"phpMyAdmin Local file inclusion through transformation feature","description":"An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.","status":"published","published":"2022-05-14T01:07:30Z","modified":"2024-04-24T18:13:52Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:45.47408Z"}],"nvd":[{"id":"CVE-2018-19968","description":"An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.","status":"published","published":"2018-12-11T17:29:00.227Z","modified":"2026-06-17T01:50:12.55Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:04:49.995593Z"}],"osv":[{"id":"CVE-2018-19968","description":"An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.","status":"published","published":"2018-12-11T17:29:00.227Z","modified":"2026-10-24T10:30:56.910083048Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"DEBIAN-CVE-2018-19968","description":"An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.","status":"published","published":"2018-12-11T17:29:00.227Z","modified":"2026-10-23T18:03:47.915955042Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"GHSA-xc97-r49q-cxgc","title":"phpMyAdmin Local file inclusion through transformation feature","description":"An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.","status":"published","published":"2022-05-14T01:07:30Z","modified":"2024-04-24T18:42:01.665081Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"UBUNTU-CVE-2018-19968","description":"An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.","status":"published","published":"2018-12-11T17:29:00Z","modified":"2026-02-04T03:40:50.208194Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"DLA-1658-1","title":"phpmyadmin - security update","status":"published","published":"2019-02-01T00:00:00Z","modified":"2026-03-09T01:18:58.081038Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"MGASA-2018-0486","title":"Updated phpmyadmin packages fix security vulnerabilities","description":"- XSS vulnerability in navigation tree was discovered\n- Local file inclusion through transformation feature\n","status":"published","published":"2018-12-20T20:17:27Z","modified":"2026-04-16T06:24:40.992749134Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:11171-1","title":"phpMyAdmin-5.1.1-1.2 on GA media","description":"These are all security issues fixed in the phpMyAdmin-5.1.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:16.460481Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-4639-1","title":"phpmyadmin vulnerabilities","description":"It was discovered that there was a bug in the way phpMyAdmin handles the\nphpMyAdmin Configuration Storage tables. An authenticated attacker could\nuse this vulnerability to cause phpmyAdmin to leak sensitive files.\n(CVE-2018-19968)\n\nIt was discovered that phpMyAdmin incorrectly handled user input. An\nattacker could possibly use this for an XSS attack. (CVE-2018-19970)\n\nIt was discovered that phpMyAdmin mishandled certain input. An attacker\ncould use this vulnerability to execute a cross-site scripting (XSS) attack\nvia a crafted URL. (CVE-2018-7260)\n\nIt was discovered that phpMyAdmin failed to sanitize certain input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted database name. (CVE-2019-11768)\n\nIt was discovered that phpmyadmin incorrectly handled some requests. An\nattacker could possibly use this to perform a CSRF attack. (CVE-2019-12616)\n\nIt was discovered that phpMyAdmin failed to sanitize certain input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted username. (CVE-2019-6798, CVE-2020-10804,\nCVE-2020-5504)\n\nIt was discovered that phpMyAdmin would allow sensitive files to be leaked\nif certain configuration options were set. An attacker could use this\nvulnerability to access confidential information. (CVE-2019-6799)\n\nIt was discovered that phpMyAdmin failed to sanitize certain input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted database or table name. (CVE-2020-10802)\n\nIt was discovered that phpMyAdmin did not properly handle data from the\ndatabase when displaying it. If an attacker were to insert specially-\ncrafted data into certain database tables, the attacker could execute a\ncross-site scripting (XSS) attack. (CVE-2020-10803)\n\nIt was discovered that phpMyAdmin was vulnerable to an XSS attack. If a\nvictim were to click on a crafted link, an attacker could run malicious\nJavaScript on the victim's system. (CVE-2020-26934)\n\nIt was discovered that phpMyAdmin did not properly handler certain SQL\nstatements in the search feature. An attacker could use this vulnerability\nto inject malicious SQL into a query. (CVE-2020-26935)\n\nIt was discovered that phpMyAdmin did not properly sanitize certain input.\nAn attacker could use this vulnerability to possibly execute an HTML injection\nor a cross-site scripting (XSS) attack. (CVE-2019-19617)\n","status":"published","published":"2020-11-19T15:01:30Z","modified":"2026-04-27T19:02:48.915048366Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-4843-1","title":"phpmyadmin vulnerabilities","description":"Javier Nieto and Andres Rojas discovered that phpMyAdmin incorrectly\nmanaged input in the form of passwords. An attacker could use this\nvulnerability to cause a denial-of-service (DoS). This issue only\naffected Ubuntu 14.04 ESM. (CVE-2014-9218)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput in the form of database names in the PHP Array export feature.\nAn authenticated attacker could use this vulnerability to run arbitrary\nPHP commands. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n(CVE-2016-6609)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput. An attacker could use this vulnerability to execute SQL injection\nattacks. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n(CVE-2016-6619)\n\nEmanuel Bronshtein discovered that phpMyadmin failed to properly sanitize\ninput. An authenticated attacker could use this vulnerability to cause a\ndenial-of-service (DoS). This issue only affected Ubuntu 14.04 ESM and\nUbuntu 16.04 ESM. (CVE-2016-6630)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput. An attacker could use this vulnerability to bypass AllowRoot\nrestrictions and deny rules for usernames. This issue only affected Ubuntu\n14.04 ESM and Ubuntu 16.04 ESM. (CVE-2016-9849)\n\nEmanuel Bronshtein discovered that phpMyAdmin would allow sensitive\ninformation to be leaked when the argument separator in a URL was\nnot the default \u0026 value. An attacker could use this vulnerability to\nobtain the CSRF token of a user. This issue only affected Ubuntu\n14.04 ESM and Ubuntu 16.04 ESM. (CVE-2016-9866)\n\nIsaac Bennetch discovered that phpMyAdmin was incorrectly restricting\nuser access due to the behavior of the substr function on some PHP\nversions. An attacker could use this vulnerability to bypass login\nrestrictions established for users that have no password set. This\nissue only affected Ubuntu 14.04 ESM. This issue only affected Ubuntu\n14.04 ESM and Ubuntu 16.04 ESM. (CVE-2017-18264)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput in the form of parameters sent during a table editing operation. An\nattacker could use this vulnerability to trigger an endless recursion\nand cause a denial-of-service (DoS). This issue only affected Ubuntu 14.04\nESM and Ubuntu 16.04 ESM. (CVE-2017-1000014)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput used to generate a web page. An authenticated attacker could use this\nvulnerability to execute CSS injection attacks. This issue only affected\nUbuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2017-1000015)\n\nIt was discovered that phpMyAdmin incorrectly handled certain input. An\nattacker could use this vulnerability to execute a cross-site scripting (XSS)\nattack via a crafted URL. This issue only affected Ubuntu 16.04 ESM.\n(CVE-2018-7260)\n\nIt was discovered phpMyAdmin incorrectly handled database names. An\nattacker could possibly use this to trigger a cross-site scripting\nattack. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM.\n(CVE-2018-12581)\n\nDaniel Le Gall discovered that phpMyAdmin would expose sensitive\ninformation to unauthorized actors due to an error in its transformation\nfeature. An authenticated attacker could use this vulnerability to leak\nthe contents of a local file. This issue only affected Ubuntu 14.04 ESM\nand Ubuntu 16.04 ESM. (CVE-2018-19968)\n\nIt was discovered that phpMyAdmin incorrectly handled user input. An\nattacker could possibly use this to perform a cross-site scripting attack.\nThis issue only affected Ubuntu 16.04 ESM. (CVE-2018-19970)\n\nIt was discovered that phpMyAdmin failed to properly sanitize input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted database name. This issue only affected Ubuntu\n16.04 ESM. (CVE-2019-11768)\n\nIt was discovered that phpMyAdmin incorrectly handled some requests. An\nattacker could possibly use this to perform a cross site request forgery\nattack. This issue only affected Ubuntu 16.04 ESM. (CVE-2019-12616)\n\nIt was discovered that phpMyAdmin incorrectly handled some requests. An\nattacker could possibly use this to perform a cross site request forgery\nattack. This issue only affected Ubuntu 14.04 ESM and Ubuntu 18.04 ESM.\n(CVE-2019-12922)\n\nIt was discovered that phpMyAdmin failed to properly sanitize input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted username. This issue only affected Ubuntu 16.04 ESM.\n(CVE-2019-6798)\n\nIt was discovered that phpMyAdmin did not properly sanitize certain input.\nAn attacker could use this vulnerability to possibly execute an HTML injection\nor a cross-site scripting (XSS) attack. This issue only affected Ubuntu 14.04\nESM and Ubuntu 16.04 ESM. (CVE-2019-19617)\n\nCSW Research Labs discovered that phpMyAdmin failed to properly sanitize\ninput.  An attacker could use this vulnerability to execute SQL injection\nattacks. This issue only affected Ubuntu 16.04 ESM. (CVE-2020-5504)\n\nGiwan Go and Yelang Lee discovered that phpMyAdmin was vulnerable to an\nXSS attack in the transformation feature. If a victim were to click on a\ncrafted link, an attacker could run malicious JavaScript on the victim's\nsystem. This issue only affected Ubuntu 20.04 ESM. (CVE-2020-26934)\n\nAndre Sá discovered that phpMyAdmin incorrectly handled certain SQL\nstatements in the search feature. A remote, authenticated attacker could\nuse this to inject malicious SQL into a query. This issue only affected\nUbuntu 20.04 ESM. (CVE-2020-26935)\n","status":"published","published":"2021-03-16T14:27:57Z","modified":"2026-06-29T13:48:33.558315723Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}