{"id":"CVE-2020-26935","aliases":["BIT-phpmyadmin-2020-26935","DEBIAN-CVE-2020-26935","DLA-2413-1","EUVD-2022-2982","GHSA-7ff4-cv53-4cjq","MGASA-2020-0383","UBUNTU-CVE-2020-26935","USN-4639-1","USN-4843-1","openSUSE-SU-2020:1675-1","openSUSE-SU-2020:1806-1","openSUSE-SU-2024:11171-1"],"status":"published","title":"phpMyAdmin SQL injection vulnerability","description":"An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.63702,"percentile":0.99224,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2020-10-10T18:26:53Z","modified":"2026-10-26T12:02:40Z","exploits":[{"source":"nuclei","id":"CVE-2020-26935","title":"phpMyAdmin \u003c 5.0.3 - SQL Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26935.yaml"}],"fixes":[{"ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","fixed_in":["4.9.6","5.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"phpmyadmin","fixed_in":["4.9.6","5.0.3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"phpmyadmin","fixed_in":["4:4.9.7+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"phpmyadmin","fixed_in":["4:4.9.7+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"phpmyadmin","fixed_in":["4:4.9.7+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"phpmyadmin","fixed_in":["4:4.6.6-5ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"phpmyadmin","fixed_in":["4:4.9.5+dfsg1-2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"4.9.6"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"phpmyadmin","ranges":[{"type":"SEMVER","events":[{"introduced":"4.9.0"},{"fixed":"4.9.6"},{"introduced":"5.0.0"},{"fixed":"5.0.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.7+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.7+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.7+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.6.6-4+deb9u2"}]}],"versions":["4:4.6.6-4","4:4.6.6-4+deb9u1"],"bundled":3},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"4.9.6"}]}],"versions":["4.9.0","4.9.0.1","4.9.1","4.9.2","4.9.3","4.9.4","4.9.5"]},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.3"}]}],"versions":["5.0.0","5.0.0.1","5.0.1","5.0.2"]},{"source":"osv","ecosystem":"Mageia:7","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.6-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.6.6-5ubuntu0.5"}]}],"versions":["4:4.6.6-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.5+dfsg1-2ubuntu0.1~esm1"}]}],"versions":["4:4.9.1+dfsg1-2","4:4.9.2+dfsg1-1","4:4.9.5+dfsg1-1ubuntu1","4:4.9.5+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.6.6-5ubuntu0.5"}]}],"versions":["4:4.6.6-5"],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.0.10-1ubuntu0.1+esm4"}]}],"versions":["4:4.0.6-1","4:4.0.8-1","4:4.0.9-1","4:4.0.10-1","4:4.0.10-1ubuntu0.1","4:4.0.10-1ubuntu0.1+esm1","4:4.0.10-1ubuntu0.1+esm2","4:4.0.10-1ubuntu0.1+esm3"],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.5.4.1-2ubuntu2.1+esm6"}]}],"versions":["4:4.4.13.1-1","4:4.5.0.2-2","4:4.5.1-1","4:4.5.1-2","4:4.5.1-3","4:4.5.2-1","4:4.5.2-2","4:4.5.3.1-1","4:4.5.4-1","4:4.5.4.1-2","4:4.5.4.1-2ubuntu1","4:4.5.4.1-2ubuntu2","4:4.5.4.1-2ubuntu2.1","4:4.5.4.1-2ubuntu2.1+esm2","4:4.5.4.1-2ubuntu2.1+esm3","4:4.5.4.1-2ubuntu2.1+esm4","4:4.5.4.1-2ubuntu2.1+esm5"],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.6.6-5ubuntu0.5+esm1"}]}],"versions":["4:4.6.6-5","4:4.6.6-5ubuntu0.2+esm1","4:4.6.6-5ubuntu0.2+esm2","4:4.6.6-5ubuntu0.5"],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.5+dfsg1-2ubuntu0.1~esm1"}]}],"versions":["4:4.9.1+dfsg1-2","4:4.9.2+dfsg1-1","4:4.9.5+dfsg1-1ubuntu1","4:4.9.5+dfsg1-2"],"bundled":21},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.6-bp152.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.6-bp152.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.6-bp152.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.6-bp152.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.6-bp152.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.7-bp151.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.7-bp151.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.7-bp151.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.7-bp151.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-1.2"}]}],"bundled":31}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"backports_sle"},{"vendor":"opensuse","product":"leap"},{"vendor":"phpmyadmin","product":"phpmyadmin"}],"references":[{"url":"https://www.phpmyadmin.net/security/PMASA-2020-6/","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory","fix","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202101-35","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://advisory.checkmarx.net/advisory/CX-2020-4281","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","advisory","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26935","tags":["web","advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmyadmin/phpmyadmin/CVE-2020-26935.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2020-6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7ff4-cv53-4cjq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-26935","tags":["advisory"]},{"url":"https://github.com/phpmyadmin/composer","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2020-0383.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27379","tags":["report"]},{"url":"https://www.phpmyadmin.net/news/2020/10/10/phpmyadmin-496-and-503-are-released/","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2020-5/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-26935","tags":["report"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/d09ab9bc9d634ad08b866d42bb8c4109869d38d2","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4639-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4843-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-26935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6799","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11768","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12616","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-19617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-5504","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-26934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6609","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6619","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6630","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9866","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-18264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000015","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12581","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12922","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IQ7OUJYMDUNUBPRBTEK6DBC7JLFD3ZZA/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1177561","tags":["report"]},{"url":"https://bugzilla.suse.com/1177562","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26935","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KALR6PYMDCEFCQ6GUH5PGVPKTXVHV3YS/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1167335","tags":["report"]},{"url":"https://bugzilla.suse.com/1167336","tags":["report"]},{"url":"https://bugzilla.suse.com/1167337","tags":["report"]},{"url":"https://bugzilla.suse.com/1177842","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10804","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2005-2869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-2031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-5504","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-26935","description":"An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.","status":"published","published":"2020-10-10T18:26:53Z","modified":"2024-08-04T16:03:23.118Z","updated_at":"2026-11-02T14:35:46.129376Z"}],"euvd":[{"id":"EUVD-2022-2982","description":"An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.","status":"published","published":"2020-10-10T18:26:53Z","modified":"2024-08-04T16:03:23Z","updated_at":"2026-11-03T03:07:13.515696Z"}],"ghsa":[{"id":"GHSA-7ff4-cv53-4cjq","title":"phpMyAdmin SQL injection vulnerability","description":"An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.","status":"published","published":"2022-05-24T17:30:27Z","modified":"2024-04-24T17:11:23Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:45.47408Z"}],"nvd":[{"id":"CVE-2020-26935","description":"An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.","status":"published","published":"2020-10-10T19:15:12.37Z","modified":"2026-06-17T03:08:34.683Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:06:19.351389Z"}],"osv":[{"id":"CVE-2020-26935","description":"An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.","status":"published","published":"2020-10-10T19:15:12.37Z","modified":"2026-10-24T10:31:00.693587752Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"DEBIAN-CVE-2020-26935","description":"An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.","status":"published","published":"2020-10-10T19:15:12.37Z","modified":"2026-10-26T12:02:40.978217022Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"GHSA-7ff4-cv53-4cjq","title":"phpMyAdmin SQL injection vulnerability","description":"An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.","status":"published","published":"2022-05-24T17:30:27Z","modified":"2024-04-24T17:28:13.736291Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"UBUNTU-CVE-2020-26935","description":"An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.","status":"published","published":"2020-10-10T19:15:00Z","modified":"2026-02-04T03:31:37.264153Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"BIT-phpmyadmin-2020-26935","description":"An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.","status":"published","published":"2024-03-06T11:02:16.797Z","modified":"2026-09-08T08:48:24.683338242Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"DLA-2413-1","title":"phpmyadmin - security update","status":"published","published":"2020-10-25T00:00:00Z","modified":"2026-03-09T01:19:14.073189Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2020-0383","title":"Updated phpmyadmin packages fix security vulnerabilities","description":"A vulnerability was discovered where an attacker can cause an XSS attack\nthrough the transformation feature. If an attacker sends a crafted link to\nthe victim with the malicious JavaScript, when the victim clicks on the link,\nthe JavaScript will run and complete the instructions made by the attacker.\n(CVE-2020-26934)\n\nAn SQL injection vulnerability was discovered in how phpMyAdmin processes\nSQL statements in the search feature. An attacker could use this flaw to\ninject malicious SQL in to a query. (CVE-2020-26935)\n","status":"published","published":"2020-10-16T15:44:59Z","modified":"2026-04-16T04:41:49.565664522Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:1675-1","title":"Security update for phpMyAdmin","description":"This update for phpMyAdmin fixes the following issues:\n\n- phpMyAdmin was updated to 4.9.6\n   * CVE-2020-26934: Fixed an XSS relating to the transformation feature (boo#1177561).\n   * CVE-2020-26935: Fixed an SQL injection in SearchController (boo#1177562).\n","status":"published","published":"2020-10-16T12:23:05Z","modified":"2026-02-04T02:35:47.594324Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1806-1","title":"Security update for phpMyAdmin","description":"This update for phpMyAdmin fixes the following issues:\n\nphpMyAdmin was updated to 4.9.7 (boo#1177842):\n  * Fix two factor authentication that was broken in 4.9.6\n  * Fix incompatibilities with older PHP versions\n\nUpdate to 4.9.6:\n\n- Fixed XSS relating to the transformation feature (boo#1177561 CVE-2020-26934, PMASA-2020-5)\n- Fixed SQL injection vulnerability in SearchController (boo#1177562 CVE-2020-26935, PMASA-2020-6) \n\nUpdate to 4.9.5:\n\nThis is a security release containing several bug fixes.\n\n  * CVE-2020-10804: SQL injection vulnerability in the user\n    accounts page, particularly when changing a password\n    (boo#1167335, PMASA-2020-2)\n  * CVE-2020-10802: SQL injection vulnerability relating to the\n    search feature (boo#1167336, PMASA-2020-3)\n  * CVE-2020-10803: SQL injection and XSS having to do with\n    displaying results (boo#1167337, PMASA-2020-4)\n  * Removing of the 'options' field for the external\n    transformation.\n  \n","status":"published","published":"2020-11-01T11:23:27Z","modified":"2026-02-04T03:03:08.383136Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:11171-1","title":"phpMyAdmin-5.1.1-1.2 on GA media","description":"These are all security issues fixed in the phpMyAdmin-5.1.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:16.460481Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-4639-1","title":"phpmyadmin vulnerabilities","description":"It was discovered that there was a bug in the way phpMyAdmin handles the\nphpMyAdmin Configuration Storage tables. An authenticated attacker could\nuse this vulnerability to cause phpmyAdmin to leak sensitive files.\n(CVE-2018-19968)\n\nIt was discovered that phpMyAdmin incorrectly handled user input. An\nattacker could possibly use this for an XSS attack. (CVE-2018-19970)\n\nIt was discovered that phpMyAdmin mishandled certain input. An attacker\ncould use this vulnerability to execute a cross-site scripting (XSS) attack\nvia a crafted URL. (CVE-2018-7260)\n\nIt was discovered that phpMyAdmin failed to sanitize certain input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted database name. (CVE-2019-11768)\n\nIt was discovered that phpmyadmin incorrectly handled some requests. An\nattacker could possibly use this to perform a CSRF attack. (CVE-2019-12616)\n\nIt was discovered that phpMyAdmin failed to sanitize certain input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted username. (CVE-2019-6798, CVE-2020-10804,\nCVE-2020-5504)\n\nIt was discovered that phpMyAdmin would allow sensitive files to be leaked\nif certain configuration options were set. An attacker could use this\nvulnerability to access confidential information. (CVE-2019-6799)\n\nIt was discovered that phpMyAdmin failed to sanitize certain input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted database or table name. (CVE-2020-10802)\n\nIt was discovered that phpMyAdmin did not properly handle data from the\ndatabase when displaying it. If an attacker were to insert specially-\ncrafted data into certain database tables, the attacker could execute a\ncross-site scripting (XSS) attack. (CVE-2020-10803)\n\nIt was discovered that phpMyAdmin was vulnerable to an XSS attack. If a\nvictim were to click on a crafted link, an attacker could run malicious\nJavaScript on the victim's system. (CVE-2020-26934)\n\nIt was discovered that phpMyAdmin did not properly handler certain SQL\nstatements in the search feature. An attacker could use this vulnerability\nto inject malicious SQL into a query. (CVE-2020-26935)\n\nIt was discovered that phpMyAdmin did not properly sanitize certain input.\nAn attacker could use this vulnerability to possibly execute an HTML injection\nor a cross-site scripting (XSS) attack. (CVE-2019-19617)\n","status":"published","published":"2020-11-19T15:01:30Z","modified":"2026-04-27T19:02:48.915048366Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-4843-1","title":"phpmyadmin vulnerabilities","description":"Javier Nieto and Andres Rojas discovered that phpMyAdmin incorrectly\nmanaged input in the form of passwords. An attacker could use this\nvulnerability to cause a denial-of-service (DoS). This issue only\naffected Ubuntu 14.04 ESM. (CVE-2014-9218)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput in the form of database names in the PHP Array export feature.\nAn authenticated attacker could use this vulnerability to run arbitrary\nPHP commands. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n(CVE-2016-6609)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput. An attacker could use this vulnerability to execute SQL injection\nattacks. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n(CVE-2016-6619)\n\nEmanuel Bronshtein discovered that phpMyadmin failed to properly sanitize\ninput. An authenticated attacker could use this vulnerability to cause a\ndenial-of-service (DoS). This issue only affected Ubuntu 14.04 ESM and\nUbuntu 16.04 ESM. (CVE-2016-6630)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput. An attacker could use this vulnerability to bypass AllowRoot\nrestrictions and deny rules for usernames. This issue only affected Ubuntu\n14.04 ESM and Ubuntu 16.04 ESM. (CVE-2016-9849)\n\nEmanuel Bronshtein discovered that phpMyAdmin would allow sensitive\ninformation to be leaked when the argument separator in a URL was\nnot the default \u0026 value. An attacker could use this vulnerability to\nobtain the CSRF token of a user. This issue only affected Ubuntu\n14.04 ESM and Ubuntu 16.04 ESM. (CVE-2016-9866)\n\nIsaac Bennetch discovered that phpMyAdmin was incorrectly restricting\nuser access due to the behavior of the substr function on some PHP\nversions. An attacker could use this vulnerability to bypass login\nrestrictions established for users that have no password set. This\nissue only affected Ubuntu 14.04 ESM. This issue only affected Ubuntu\n14.04 ESM and Ubuntu 16.04 ESM. (CVE-2017-18264)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput in the form of parameters sent during a table editing operation. An\nattacker could use this vulnerability to trigger an endless recursion\nand cause a denial-of-service (DoS). This issue only affected Ubuntu 14.04\nESM and Ubuntu 16.04 ESM. (CVE-2017-1000014)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput used to generate a web page. An authenticated attacker could use this\nvulnerability to execute CSS injection attacks. This issue only affected\nUbuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2017-1000015)\n\nIt was discovered that phpMyAdmin incorrectly handled certain input. An\nattacker could use this vulnerability to execute a cross-site scripting (XSS)\nattack via a crafted URL. This issue only affected Ubuntu 16.04 ESM.\n(CVE-2018-7260)\n\nIt was discovered phpMyAdmin incorrectly handled database names. An\nattacker could possibly use this to trigger a cross-site scripting\nattack. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM.\n(CVE-2018-12581)\n\nDaniel Le Gall discovered that phpMyAdmin would expose sensitive\ninformation to unauthorized actors due to an error in its transformation\nfeature. An authenticated attacker could use this vulnerability to leak\nthe contents of a local file. This issue only affected Ubuntu 14.04 ESM\nand Ubuntu 16.04 ESM. (CVE-2018-19968)\n\nIt was discovered that phpMyAdmin incorrectly handled user input. An\nattacker could possibly use this to perform a cross-site scripting attack.\nThis issue only affected Ubuntu 16.04 ESM. (CVE-2018-19970)\n\nIt was discovered that phpMyAdmin failed to properly sanitize input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted database name. This issue only affected Ubuntu\n16.04 ESM. (CVE-2019-11768)\n\nIt was discovered that phpMyAdmin incorrectly handled some requests. An\nattacker could possibly use this to perform a cross site request forgery\nattack. This issue only affected Ubuntu 16.04 ESM. (CVE-2019-12616)\n\nIt was discovered that phpMyAdmin incorrectly handled some requests. An\nattacker could possibly use this to perform a cross site request forgery\nattack. This issue only affected Ubuntu 14.04 ESM and Ubuntu 18.04 ESM.\n(CVE-2019-12922)\n\nIt was discovered that phpMyAdmin failed to properly sanitize input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted username. This issue only affected Ubuntu 16.04 ESM.\n(CVE-2019-6798)\n\nIt was discovered that phpMyAdmin did not properly sanitize certain input.\nAn attacker could use this vulnerability to possibly execute an HTML injection\nor a cross-site scripting (XSS) attack. This issue only affected Ubuntu 14.04\nESM and Ubuntu 16.04 ESM. (CVE-2019-19617)\n\nCSW Research Labs discovered that phpMyAdmin failed to properly sanitize\ninput.  An attacker could use this vulnerability to execute SQL injection\nattacks. This issue only affected Ubuntu 16.04 ESM. (CVE-2020-5504)\n\nGiwan Go and Yelang Lee discovered that phpMyAdmin was vulnerable to an\nXSS attack in the transformation feature. If a victim were to click on a\ncrafted link, an attacker could run malicious JavaScript on the victim's\nsystem. This issue only affected Ubuntu 20.04 ESM. (CVE-2020-26934)\n\nAndre Sá discovered that phpMyAdmin incorrectly handled certain SQL\nstatements in the search feature. A remote, authenticated attacker could\nuse this to inject malicious SQL into a query. This issue only affected\nUbuntu 20.04 ESM. (CVE-2020-26935)\n","status":"published","published":"2021-03-16T14:27:57Z","modified":"2026-06-29T13:48:33.558315723Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}