{"id":"CVE-2020-10802","aliases":["ALPINE-CVE-2020-10802","BIT-phpmyadmin-2020-10802","DEBIAN-CVE-2020-10802","DLA-2154-1","EUVD-2022-3684","GHSA-f4cr-3xmc-2wpm","MGASA-2020-0150","UBUNTU-CVE-2020-10802","USN-4639-1","openSUSE-SU-2020:0405-1","openSUSE-SU-2020:0427-1","openSUSE-SU-2020:1806-1","openSUSE-SU-2024:11171-1"],"status":"published","title":"phpMyAdmin SQL injection vulnerability","description":"In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01824,"percentile":0.7897,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2020-03-22T00:00:00Z","modified":"2026-11-03T06:32:35Z","fixes":[{"ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","fixed_in":["4.9.5","5.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.11","package":"phpmyadmin","fixed_in":["4.9.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"phpmyadmin","fixed_in":["5.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"phpmyadmin","fixed_in":["5.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"phpmyadmin","fixed_in":["5.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"phpmyadmin","fixed_in":["5.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"phpmyadmin","fixed_in":["5.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"phpmyadmin","fixed_in":["5.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"phpmyadmin","fixed_in":["5.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"phpmyadmin","fixed_in":["5.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"phpmyadmin","fixed_in":["5.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"phpmyadmin","fixed_in":["5.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"phpmyadmin","fixed_in":["5.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"phpmyadmin","fixed_in":["5.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"phpmyadmin","fixed_in":["5.0.2-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"phpmyadmin","fixed_in":["4.9.5","5.0.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"phpmyadmin","fixed_in":["4:4.9.5+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"phpmyadmin","fixed_in":["4:4.9.5+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"phpmyadmin","fixed_in":["4:4.9.5+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"phpmyadmin","fixed_in":["4:4.6.6-5ubuntu0.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"4.9.5"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.9.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.0.2-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"phpmyadmin","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.9.5"},{"introduced":"5.0.0"},{"fixed":"5.0.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.5+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.5+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.5+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.2.12-2+deb8u9"}]}],"versions":["4:4.2.12-2","4:4.2.12-2+deb8u1","4:4.2.12-2+deb8u2","4:4.2.12-2+deb8u3","4:4.2.12-2+deb8u4","4:4.2.12-2+deb8u5","4:4.2.12-2+deb8u6","4:4.2.12-2+deb8u7","4:4.2.12-2+deb8u8"],"bundled":2},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"4.9.5"}]}],"versions":["4.9.0","4.9.0.1","4.9.1","4.9.2","4.9.3","4.9.4"]},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.2"}]}],"versions":["5.0.0","5.0.0.1","5.0.1"]},{"source":"osv","ecosystem":"Mageia:7","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-1.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.0.6-1","4:4.0.8-1","4:4.0.9-1","4:4.0.10-1","4:4.0.10-1ubuntu0.1","4:4.0.10-1ubuntu0.1+esm1","4:4.0.10-1ubuntu0.1+esm2","4:4.0.10-1ubuntu0.1+esm3","4:4.0.10-1ubuntu0.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.4.13.1-1","4:4.5.0.2-2","4:4.5.1-1","4:4.5.1-2","4:4.5.1-3","4:4.5.2-1","4:4.5.2-2","4:4.5.3.1-1","4:4.5.4-1","4:4.5.4.1-2","4:4.5.4.1-2ubuntu1","4:4.5.4.1-2ubuntu2","4:4.5.4.1-2ubuntu2.1","4:4.5.4.1-2ubuntu2.1+esm2","4:4.5.4.1-2ubuntu2.1+esm3","4:4.5.4.1-2ubuntu2.1+esm4","4:4.5.4.1-2ubuntu2.1+esm5","4:4.5.4.1-2ubuntu2.1+esm6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.6.6-5ubuntu0.5"}]}],"versions":["4:4.6.6-5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.6.6-5ubuntu0.5"}]}],"versions":["4:4.6.6-5"],"bundled":14},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-43.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-43.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-bp151.3.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.7-bp151.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.7-bp151.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.7-bp151.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.7-bp151.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-1.2"}]}],"bundled":31}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"backports_sle"},{"vendor":"opensuse","product":"leap"},{"vendor":"phpmyadmin","product":"phpmyadmin"},{"vendor":"suse","product":"package_hub"}],"references":[{"url":"https://www.phpmyadmin.net/security/PMASA-2020-3/","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10802","tags":["web","advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmyadmin/phpmyadmin/CVE-2020-10802.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2020-3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f4cr-3xmc-2wpm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-10802","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-10802","tags":["advisory"]},{"url":"https://github.com/phpmyadmin/composer","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2020-0150.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26372","tags":["report"]},{"url":"https://www.phpmyadmin.net/news/2020/3/21/phpmyadmin-495-and-502-are-released/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-10802","tags":["report"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/a8acd7a42cf743186528b0453f90aaa32bfefabe","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4639-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6799","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11768","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12616","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-19617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-5504","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-26934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-26935","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7767YODHXD55I7XUDQWROFHBML4MXA2P/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1167335","tags":["report"]},{"url":"https://bugzilla.suse.com/1167336","tags":["report"]},{"url":"https://bugzilla.suse.com/1167337","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10804","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SCTHN34UUFD4SUA5QZOA62C63LIEO2ML/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KALR6PYMDCEFCQ6GUH5PGVPKTXVHV3YS/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1177561","tags":["report"]},{"url":"https://bugzilla.suse.com/1177562","tags":["report"]},{"url":"https://bugzilla.suse.com/1177842","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26935","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2005-2869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-2031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-5504","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-10802","description":"In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.","status":"published","published":"2020-03-22T03:48:33Z","modified":"2024-08-04T11:14:15.611Z","updated_at":"2026-11-02T14:35:48.213211Z"}],"euvd":[{"id":"EUVD-2022-3684","description":"In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.","status":"published","published":"2020-03-22T03:48:33Z","modified":"2024-08-04T11:14:15Z","updated_at":"2026-11-03T03:07:48.471313Z"}],"ghsa":[{"id":"GHSA-f4cr-3xmc-2wpm","title":"phpMyAdmin SQL injection vulnerability","description":"In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.","status":"published","published":"2022-05-24T17:12:07Z","modified":"2024-04-24T17:40:19Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:45.47408Z"}],"nvd":[{"id":"CVE-2020-10802","description":"In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.","status":"published","published":"2020-03-22T05:15:11.603Z","modified":"2026-06-17T02:48:27.727Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:05:56.580228Z"}],"osv":[{"id":"ALPINE-CVE-2020-10802","description":"In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.","status":"published","published":"2020-03-22T05:15:11.603Z","modified":"2026-11-03T06:32:35.852547259Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"CVE-2020-10802","description":"In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.","status":"published","published":"2020-03-22T05:15:11.603Z","modified":"2026-10-24T10:30:48.250692242Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:13.492058Z"},{"id":"DEBIAN-CVE-2020-10802","description":"In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.","status":"published","published":"2020-03-22T05:15:11.603Z","modified":"2026-10-26T12:01:14.638547677Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"GHSA-f4cr-3xmc-2wpm","title":"phpMyAdmin SQL injection vulnerability","description":"In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.","status":"published","published":"2022-05-24T17:12:07Z","modified":"2024-04-24T17:57:28.533884Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"UBUNTU-CVE-2020-10802","description":"In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.","status":"published","published":"2020-03-22T05:15:00Z","modified":"2026-02-04T04:32:01.838696Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"BIT-phpmyadmin-2020-10802","description":"In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.","status":"published","published":"2024-03-06T11:03:28.787Z","modified":"2026-09-08T08:48:24.768767541Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"DLA-2154-1","title":"phpmyadmin - security update","status":"published","published":"2020-03-22T00:00:00Z","modified":"2026-03-09T01:18:30.540789Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2020-0150","title":"Updated phpmyadmin packages fix security vulnerability","description":"Some SQL injections via table names and parameters were fixed.\n","status":"published","published":"2020-04-01T01:56:57Z","modified":"2026-04-16T04:41:33.355846596Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0405-1","title":"Security update for phpMyAdmin","description":"This update for phpMyAdmin to version 4.9.5 fixes the following issues:\n\n- phpmyadmin was updated to 4.9.5: \n\n- CVE-2020-10804: Fixed an SQL injection in the user accounts page, \n  particularly when changing a password (boo#1167335 PMASA-2020-2).\n- CVE-2020-10802: Fixed an SQL injection in the search feature \n  (boo#1167336 PMASA-2020-3).\n- CVE-2020-10803: Fixed an SQL injection and XSS when displaying \n  results (boo#1167337 PMASA-2020-4).\n- Removed the 'options' field for the external transformation.\n","status":"published","published":"2020-03-29T16:17:08Z","modified":"2026-02-04T04:10:34.522433Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0427-1","title":"Security update for phpMyAdmin","description":"This update for phpMyAdmin to version 4.9.5 fixes the following issues:\n\n- phpmyadmin was updated to 4.9.5: \n\n- CVE-2020-10804: Fixed an SQL injection in the user accounts page, \n  particularly when changing a password (boo#1167335 PMASA-2020-2).\n- CVE-2020-10802: Fixed an SQL injection in the search feature \n  (boo#1167336 PMASA-2020-3).\n- CVE-2020-10803: Fixed an SQL injection and XSS when displaying \n  results (boo#1167337 PMASA-2020-4).\n- Removed the 'options' field for the external transformation.\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2020-03-31T13:05:19Z","modified":"2026-02-04T02:39:30.986499Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:1806-1","title":"Security update for phpMyAdmin","description":"This update for phpMyAdmin fixes the following issues:\n\nphpMyAdmin was updated to 4.9.7 (boo#1177842):\n  * Fix two factor authentication that was broken in 4.9.6\n  * Fix incompatibilities with older PHP versions\n\nUpdate to 4.9.6:\n\n- Fixed XSS relating to the transformation feature (boo#1177561 CVE-2020-26934, PMASA-2020-5)\n- Fixed SQL injection vulnerability in SearchController (boo#1177562 CVE-2020-26935, PMASA-2020-6) \n\nUpdate to 4.9.5:\n\nThis is a security release containing several bug fixes.\n\n  * CVE-2020-10804: SQL injection vulnerability in the user\n    accounts page, particularly when changing a password\n    (boo#1167335, PMASA-2020-2)\n  * CVE-2020-10802: SQL injection vulnerability relating to the\n    search feature (boo#1167336, PMASA-2020-3)\n  * CVE-2020-10803: SQL injection and XSS having to do with\n    displaying results (boo#1167337, PMASA-2020-4)\n  * Removing of the 'options' field for the external\n    transformation.\n  \n","status":"published","published":"2020-11-01T11:23:27Z","modified":"2026-02-04T03:03:08.383136Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:11171-1","title":"phpMyAdmin-5.1.1-1.2 on GA media","description":"These are all security issues fixed in the phpMyAdmin-5.1.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:16.460481Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-4639-1","title":"phpmyadmin vulnerabilities","description":"It was discovered that there was a bug in the way phpMyAdmin handles the\nphpMyAdmin Configuration Storage tables. An authenticated attacker could\nuse this vulnerability to cause phpmyAdmin to leak sensitive files.\n(CVE-2018-19968)\n\nIt was discovered that phpMyAdmin incorrectly handled user input. An\nattacker could possibly use this for an XSS attack. (CVE-2018-19970)\n\nIt was discovered that phpMyAdmin mishandled certain input. An attacker\ncould use this vulnerability to execute a cross-site scripting (XSS) attack\nvia a crafted URL. (CVE-2018-7260)\n\nIt was discovered that phpMyAdmin failed to sanitize certain input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted database name. (CVE-2019-11768)\n\nIt was discovered that phpmyadmin incorrectly handled some requests. An\nattacker could possibly use this to perform a CSRF attack. (CVE-2019-12616)\n\nIt was discovered that phpMyAdmin failed to sanitize certain input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted username. (CVE-2019-6798, CVE-2020-10804,\nCVE-2020-5504)\n\nIt was discovered that phpMyAdmin would allow sensitive files to be leaked\nif certain configuration options were set. An attacker could use this\nvulnerability to access confidential information. (CVE-2019-6799)\n\nIt was discovered that phpMyAdmin failed to sanitize certain input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted database or table name. (CVE-2020-10802)\n\nIt was discovered that phpMyAdmin did not properly handle data from the\ndatabase when displaying it. If an attacker were to insert specially-\ncrafted data into certain database tables, the attacker could execute a\ncross-site scripting (XSS) attack. (CVE-2020-10803)\n\nIt was discovered that phpMyAdmin was vulnerable to an XSS attack. If a\nvictim were to click on a crafted link, an attacker could run malicious\nJavaScript on the victim's system. (CVE-2020-26934)\n\nIt was discovered that phpMyAdmin did not properly handler certain SQL\nstatements in the search feature. An attacker could use this vulnerability\nto inject malicious SQL into a query. (CVE-2020-26935)\n\nIt was discovered that phpMyAdmin did not properly sanitize certain input.\nAn attacker could use this vulnerability to possibly execute an HTML injection\nor a cross-site scripting (XSS) attack. (CVE-2019-19617)\n","status":"published","published":"2020-11-19T15:01:30Z","modified":"2026-04-27T19:02:48.915048366Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}