{"id":"CVE-2022-0813","aliases":["BIT-phpmyadmin-2022-0813","DEBIAN-CVE-2022-0813","EUVD-2022-1557","GHSA-vx8q-j7h9-vf6q","UBUNTU-CVE-2022-0813","openSUSE-SU-2023:0047-1","openSUSE-SU-2024:12191-1"],"status":"published","title":"PhpMyAdmin exposure of sensitive information","description":"PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01296,"percentile":0.70551,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2022-03-09T14:59:28Z","modified":"2026-11-03T08:01:47Z","fixes":[{"ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","fixed_in":["5.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"phpmyadmin","fixed_in":["5.1.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"phpmyadmin","fixed_in":["4:5.1.3+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"phpmyadmin","fixed_in":["4:5.1.3+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"phpmyadmin","fixed_in":["4:5.1.3+dfsg1-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"phpMyAdmin","fixed_in":["5.2.0-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"phpmyadmin","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.1.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.1.3+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.1.3+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.1.3+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3"}]}],"versions":["4.0.0","4.0.1","4.0.10","4.0.10.1","4.0.10.2","4.0.10.3","4.0.10.4","4.0.10.5","4.0.10.6","4.0.10.7","4.0.10.8","4.0.10.9","4.0.2","4.0.3","4.0.4","4.0.4.1","4.0.4.2","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.7.0","4.7.1","4.7.2","4.7.3","4.7.4","4.7.5","4.7.6","4.7.7","4.7.8","4.7.9","4.8.0","4.8.0.1","4.8.1","4.8.2","4.8.3","4.8.4","4.8.5","4.9.0","4.9.0.1","4.9.1","4.9.10","4.9.11","4.9.2","4.9.3","4.9.4","4.9.5","4.9.6","4.9.7","4.9.8","4.9.9","5.0.0","5.0.0.1","5.0.1","5.0.2","5.0.3","5.0.4","5.1.0","5.1.1","5.1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.0.6-1","4:4.0.8-1","4:4.0.9-1","4:4.0.10-1","4:4.0.10-1ubuntu0.1","4:4.0.10-1ubuntu0.1+esm1","4:4.0.10-1ubuntu0.1+esm2","4:4.0.10-1ubuntu0.1+esm3","4:4.0.10-1ubuntu0.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.4.13.1-1","4:4.5.0.2-2","4:4.5.1-1","4:4.5.1-2","4:4.5.1-3","4:4.5.2-1","4:4.5.2-2","4:4.5.3.1-1","4:4.5.4-1","4:4.5.4.1-2","4:4.5.4.1-2ubuntu1","4:4.5.4.1-2ubuntu2","4:4.5.4.1-2ubuntu2.1","4:4.5.4.1-2ubuntu2.1+esm2","4:4.5.4.1-2ubuntu2.1+esm3","4:4.5.4.1-2ubuntu2.1+esm4","4:4.5.4.1-2ubuntu2.1+esm5","4:4.5.4.1-2ubuntu2.1+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.6.6-5","4:4.6.6-5ubuntu0.2+esm1","4:4.6.6-5ubuntu0.2+esm2","4:4.6.6-5ubuntu0.5","4:4.6.6-5ubuntu0.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.9.1+dfsg1-2","4:4.9.2+dfsg1-1","4:4.9.5+dfsg1-1ubuntu1","4:4.9.5+dfsg1-2","4:4.9.5+dfsg1-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:5.0.4+dfsg2-2ubuntu5","4:5.1.1+dfsg1-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:5.2.1+dfsg-1ubuntu1","4:5.2.1+dfsg-2ubuntu1","4:5.2.1+dfsg-2ubuntu2","4:5.2.1+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:5.2.2-really5.2.2+20250121+dfsg-1","4:5.2.2-really+dfsg-1","4:5.2.2-really+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:5.2.3+dfsg-1","4:5.2.4~dev~git20260809.e0909b211b+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:5.2.2-really+dfsg-2","4:5.2.3+dfsg-1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-bp154.2.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-bp154.2.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-2.1"}]}]}],"products":[{"vendor":"phpmyadmin","product":"phpmyadmin"}],"references":[{"url":"https://www.incibe-cert.es/en/early-warning/security-advisories/phpmyadmin-exposure-sensitive-information","tags":["x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://www.phpmyadmin.net/news/2022/2/11/phpmyadmin-4910-and-513-are-released/","tags":["x_transferred","Release Notes","Vendor Advisory","advisory","web","report"]},{"url":"https://security.gentoo.org/glsa/202311-17","tags":["vendor-advisory","x_transferred","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0813","tags":["web","advisory"]},{"url":"https://www.phpmyadmin.net/news/2022/2/11/phpmyadmin-4910-and-513-are-released","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vx8q-j7h9-vf6q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0813.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-0813","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-0813","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0813","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VQ5VVS2CGDQ32RHYLQQZFFFADPEZO6KM/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1195017","tags":["report"]},{"url":"https://bugzilla.suse.com/1195018","tags":["report"]},{"url":"https://bugzilla.suse.com/1197036","tags":["report"]},{"url":"https://bugzilla.suse.com/1208186","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25727","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-0813","title":"PhpMyAdmin exposure of sensitive information","description":"PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.","status":"published","published":"2022-03-09T14:59:28.954Z","modified":"2024-09-16T23:51:38.854Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:41.69911Z"}],"euvd":[{"id":"EUVD-2022-1557","description":"PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.","status":"published","published":"2022-03-09T14:59:28Z","modified":"2024-09-16T23:51:38Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:29:04.415682Z"}],"ghsa":[{"id":"GHSA-vx8q-j7h9-vf6q","title":"Exposure of Sensitive Information to an Unauthorized Actor in PhpMyAdmin","description":"PhpMyAdmin before 5.1.3 allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.","status":"published","published":"2022-03-11T00:02:24Z","modified":"2024-04-22T19:10:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:44.335614Z"}],"nvd":[{"id":"CVE-2022-0813","description":"PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.","status":"published","published":"2022-03-10T17:44:57.003Z","modified":"2026-06-17T04:21:18.21Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:07:13.7085Z"}],"osv":[{"id":"CVE-2022-0813","title":"PhpMyAdmin exposure of sensitive information","description":"PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.","status":"published","published":"2022-03-09T14:59:28.954Z","modified":"2026-10-28T02:31:13.095827907Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:22.824781Z"},{"id":"DEBIAN-CVE-2022-0813","description":"PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.","status":"published","published":"2022-03-10T17:44:57.003Z","modified":"2026-11-03T08:01:47.399313762Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"GHSA-vx8q-j7h9-vf6q","title":"Exposure of Sensitive Information to an Unauthorized Actor in PhpMyAdmin","description":"PhpMyAdmin before 5.1.3 allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.","status":"published","published":"2022-03-11T00:02:24Z","modified":"2024-04-22T19:44:14.713788Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"UBUNTU-CVE-2022-0813","description":"PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.","status":"published","published":"2022-03-10T17:44:00Z","modified":"2026-10-17T12:55:55.931451578Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"BIT-phpmyadmin-2022-0813","title":"PhpMyAdmin exposure of sensitive information","description":"PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.","status":"published","published":"2024-03-06T11:01:57.863Z","modified":"2026-09-08T08:47:35.908185384Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"openSUSE-SU-2023:0047-1","title":"Security update for phpMyAdmin","description":"This update for phpMyAdmin fixes the following issues:\n\nphpMyAdmin was updated to 5.2.1\n\nThis is a security and bufix release.\n\n* Security:\n\n  - Fix (PMASA-2023-01, CWE-661, boo#1208186, CVE-2023-25727) \n    Fix an XSS attack through the drag-and-drop upload feature.\n\n* Bugfixes:\n\n  - issue #17522 Fix case where the routes cache file is invalid\n  - issue #17506 Fix error when configuring 2FA without XMLWriter or Imagick\n  - issue        Fix blank page when some error occurs\n  - issue #17519 Fix Export pages not working in certain conditions\n  - issue #17496 Fix error in table operation page when partitions are broken\n  - issue #17386 Fix system memory and system swap values on Windows\n  - issue #17517 Fix Database Server panel not getting hidden by ShowServerInfo configuration directive\n  - issue #17271 Fix database names not showing on Processes tab\n  - issue #17424 Fix export limit size calculation\n  - issue #17366 Fix refresh rate popup on Monitor page\n  - issue #17577 Fix monitor charts size on RTL languages\n  - issue #17121 Fix password_hash function incorrectly adding single quotes to password before hashing\n  - issue #17586 Fix statistics not showing for empty databases\n  - issue #17592 Clicking on the New index link on the sidebar does not throw an error anymore\n  - issue #17584 It's now possible to browse a database that includes two % in its name\n  - issue        Fix PHP 8.2 deprecated string interpolation syntax\n  - issue        Some languages are now correctly detected from the HTTP header\n  - issue #17617 Sorting is correctly remembered when $cfg['RememberSorting'] is true\n  - issue #17593 Table filtering now works when action buttons are on the right side of the row\n  - issue #17388 Find and Replace using regex now makes a valid query if no matching result set found\n  - issue #17551 Enum/Set editor will not fail to open when creating a new column\n  - issue #17659 Fix error when a database group is named tables, views, functions, procedures or events\n  - issue #17673 Allow empty values to be inserted into columns\n  - issue #17620 Fix error handling at phpMyAdmin startup for the JS SQL console\n  - issue        Fixed debug queries console broken UI for query time and group count\n  - issue        Fixed escaping of SQL query and errors for the debug console\n  - issue        Fix console toolbar UI when the bookmark feature is disabled and sql debug is enabled\n  - issue #17543 Fix JS error on saving a new designer page\n  - issue #17546 Fix JS error after using save as and open page operation on the designer\n  - issue        Fix PHP warning on GIS visualization when there is only one GIS column\n  - issue #17728 Some select HTML tags will now have the correct UI style\n  - issue #17734 PHP deprecations will only be shown when in a development environment\n  - issue #17369 Fix server error when blowfish_secret is not exactly 32 bytes long\n  - issue #17736 Add utf8mb3 as an alias of utf8 on the charset description page\n  - issue #16418 Fix FAQ 1.44 about manually removing vendor folders\n  - issue #12359 Setup page now sends the Content-Security-Policy headers\n  - issue #17747 The Column Visibility Toggle will not be hidden by other elements\n  - issue #17756 Edit/Copy/Delete row now works when using GROUP BY\n  - issue #17248 Support the UUID data type for MariaDB \u003e= 10.7\n  - issue #17656 Fix replace/change/set table prefix is not working\n  - issue        Fix monitor page filter queries only filtering the first row\n  - issue        Fix 'Link not found!' on foreign columns for tables having no char column to show\n  - issue #17390 Fix 'Create view' modal doesn't show on results and empty results\n  - issue #17772 Fix wrong styles for add button from central columns\n  - issue #17389 Fix HTML disappears when exporting settings to browser's storage\n  - issue #17166 Fix 'Warning: #1287 'X' is deprecated [...] Please use ST_X instead.' on search page\n  - issue        Use jquery-migrate.min.js (14KB) instead of jquery-migrate.min.js (31KB)\n  - issue #17842 Use jquery.validate.min.js (24 KB) instead of jquery.validate.js (50 KB)\n  - issue #17281 Fix links to databases for information_schema.SCHEMATA\n  - issue #17553 Fix Metro theme unreadable links above navigation tree\n  - issue #17553 Metro theme UI fixes and improvements\n  - issue #17553 Fix Metro theme login form with\n  - issue #16042 Exported gzip file of database has first ~73 kB uncompressed and rest is gzip compressed in Firefox\n  - issue #17705 Fix inline SQL query edit FK checkbox preventing submit buttons from working\n  - issue #17777 Fix Uncaught TypeError: Cannot read properties of null (reading 'inline') on datepickers when re-opened\n  - issue        Fix Original theme buttons style and login form width\n  - issue #17892 Fix closing index edit modal and reopening causes it to fire twice\n  - issue #17606 Fix preview SQL modal not working inside 'Add Index' modal\n  - issue        Fix PHP error on adding new column on create table form\n  - issue #17482 Default to 'Full texts' when running explain statements\n  - issue        Fixed Chrome scrolling performance issue on a textarea of an 'export as text' page\n  - issue #17703 Fix datepicker appears on all fields, not just date\n  - issue        Fix space in the tree line when a DB is expanded\n  - issue #17340 Fix 'New Table' page -\u003e 'VIRTUAL' attribute is lost when adding a new column\n  - issue #17446 Fix missing option for STORED virtual column on MySQL and PERSISTENT is not supported on MySQL\n  - issue #17446 Lower the check for virtual columns to MySQL\u003e=5.7.6 nothing is supported on 5.7.5\n  - issue        Fix column names option for CSV Export\n  - issue #17177 Fix preview SQL when reordering columns doesn't work on move columns\n  - issue #15887 Fixed DROP TABLE errors ignored on multi table select for DROP\n  - issue #17944 Fix unable to create a view from tree view button\n  - issue #17927 Fix key navigation between select inputs (drop an old Firefox workaround)\n  - issue #17967 Fix missing icon for collapse all button\n  - issue #18006 Fixed UUID columns can't be moved\n  - issue        Add `spellcheck='false'` to all password fields and some text fields to avoid spell-jacking data leaks\n  - issue        Remove non working 'Analyze Explain at MariaDB.org' button (MariaDB stopped this service)\n  - issue #17229 Add support for Web Authentication API because Chrome removed support for the U2F API\n  - issue #18019 Fix 'Call to a member function fetchAssoc() on bool' with SQL mode ONLY_FULL_GROUP_BY on monitor search logs\n  - issue        Add back UUID and UUID_SHORT to functions on MySQL and all MariaDB versions\n  - issue #17398 Fix clicking on JSON columns triggers update query\n  - issue        Fix silent JSON parse error on upload progress\n  - issue #17833 Fix 'Add Parameter' button not working for Add Routine Screen\n  - issue #17365 Fixed 'Uncaught Error: regexp too big' on server status variables page\n\nUpdate to 5.2.0\n\n* Bugfix\n\n  - issue #16521 Upgrade Bootstrap to version 5\n  - issue #16521 Drop support for Internet Explorer and others\n  - issue        Upgrade to shapefile 3\n  - issue #16555 Bump minimum PHP version to 7.2\n  - issue        Remove the phpseclib dependency\n  - issue        Upgrade Symfony components to version 5.2\n  - issue        Upgrade to Motranslator 4\n  - issue #16005 Improve the performance of the Export logic\n  - issue #16829 Add NOT LIKE %...% operator to Table search\n  - issue #16845 Fixed some links not passing through url.php\n  - issue #16382 Remove apc upload progress method (all upload progress code was removed from the PHP extension)\n  - issue #16974 Replace zxcvbn by zxcvbn-ts\n  - issue #15691 Disable the last column checkbox in the column list dropdown instead of not allowing un-check\n  - issue #16138 Ignore the length of integer types and show a warning on MySQL \u003e= 8.0.18\n  - issue        Add support for the Mroonga engine\n  - issue        Double click column name to directly copy to clipboard\n  - issue #16425 Add DELETE FROM table on table operations page\n  - issue #16482 Add a select all link for table-specific privileges\n  - issue #14276 Add support for account locking\n  - issue #17143 Use composer/ca-bundle to manage the CA cert file\n  - issue #17143 Require the openssl PHP extension\n  - issue #17171 Remove the printview.css file from themes\n  - issue #17203 Redesign the export and the import pages\n  - issue #16197 Replace the master/slave terminology\n  - issue #17257 Replace libraries/vendor_config.php constants with an array\n  - issue        Add the Bootstrap theme\n  - issue #17499 Remove stickyfilljs JavaScript dependency\n\nUpdate to 5.1.3\n\nThis is a security and bufix release.\n\n* Security\n\n  - Fix for boo#1197036 (CVE-2022-0813)\n  - Fix for path disclosure under certain server configurations\n    (if display_errors is on, for instance)\n\n* Bugfix\n\n  - issue #17308 Fix broken pagination links in the navigation sidebar\n  - issue #17331 Fix MariaDB has no support for system variable 'disabled_storage_engines'\n  - issue #17315 Fix unsupported operand types in Results.php when running 'SHOW PROCESSLIST' SQL query\n  - issue #17288 Fixed importing browser settings question box after login when having no pmadb\n  - issue #17288 Fix 'First day of calendar' user override has no effect\n  - issue #17239 Fixed repeating headers are not working\n  - issue #17298 Fixed import of email-adresses or links from ODS results in empty contents\n  - issue #17344 Fixed a type error on ODS import with non string values\n  - issue #17239 Fixed header row show/hide columns buttons on each line after hover are shown on each row\n\nUpdate to 5.1.2\n\nThis is a security and bufix release.\n\n* Security\n\n  - Fix boo#1195017 (CVE-2022-23807, PMASA-2022-1, CWE-661) \n    Two factor authentication bypass\n  - Fix boo#1195018 (CVE-2022-23808, PMASA-2022-2, CWE-661)\n    Multiple XSS and HTML injection attacks in setup script\n\n* Bugfixes\n\n  - Revert a changed to $cfg['CharTextareaRows'] allow values\n    less than 7\n  - Fix encoding of enum and set values on edit value\n  - Fixed possible 'Undefined index: clause_is_unique' error\n  - Fixed some situations where a user is logged out when working\n    with more than one server\n  - Fixed a problem with assigning privileges to a user using the\n    multiselect list when the database name has an underscore\n  - Enable cookie parameter 'SameSite' when the PHP version\n    is 7.3 or newer\n  - Correctly handle the removal of 'innodb_file_format' in\n    MariaDB and MySQL\n\n","status":"published","published":"2023-02-15T10:21:02Z","modified":"2025-05-07T18:13:32.484393Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12191-1","title":"phpMyAdmin-5.2.0-2.1 on GA media","description":"These are all security issues fixed in the phpMyAdmin-5.2.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:28:44.64782Z","updated_at":"2026-11-02T16:58:35.485255Z"}]}}