{"id":"CVE-2022-23807","aliases":["ALPINE-CVE-2022-23807","BIT-phpmyadmin-2022-23807","DEBIAN-CVE-2022-23807","EUVD-2022-0533","GHSA-8wf2-3ggj-78q9","MGASA-2022-0036","UBUNTU-CVE-2022-23807","openSUSE-SU-2023:0047-1","openSUSE-SU-2023:0154-1","openSUSE-SU-2024:11765-1"],"status":"published","title":"Improper Authentication in phpmyadmin","description":"An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00738,"percentile":0.54793,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2022-01-22T00:00:00Z","modified":"2026-11-03T08:02:05Z","fixes":[{"ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","fixed_in":["4.9.8","5.1.2"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.15","package":"phpmyadmin","fixed_in":["5.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"phpmyadmin","fixed_in":["5.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"phpmyadmin","fixed_in":["5.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"phpmyadmin","fixed_in":["5.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"phpmyadmin","fixed_in":["5.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"phpmyadmin","fixed_in":["5.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"phpmyadmin","fixed_in":["5.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"phpmyadmin","fixed_in":["5.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"phpmyadmin","fixed_in":["5.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"phpmyadmin","fixed_in":["5.1.2-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"phpmyadmin","fixed_in":["4.9.8","5.1.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"phpmyadmin","fixed_in":["4:5.1.3+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"phpmyadmin","fixed_in":["4:5.1.3+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"phpmyadmin","fixed_in":["4:5.1.3+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"4.9.8"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"5.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"5.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"5.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"5.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"5.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"5.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"5.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"5.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"5.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"5.1.2-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"phpmyadmin","ranges":[{"type":"SEMVER","events":[{"introduced":"4.9.0"},{"fixed":"4.9.8"},{"introduced":"5.1.0"},{"fixed":"5.1.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.1.3+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.1.3+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.1.3+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"4.9.8"}]}],"versions":["4.9.0","4.9.0.1","4.9.1","4.9.2","4.9.3","4.9.4","4.9.5","4.9.6","4.9.7"]},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.2"}]}],"versions":["5.1.0","5.1.1"]},{"source":"osv","ecosystem":"Mageia:8","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.9.1+dfsg1-2","4:4.9.2+dfsg1-1","4:4.9.5+dfsg1-1ubuntu1","4:4.9.5+dfsg1-2","4:4.9.5+dfsg1-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:5.0.4+dfsg2-2ubuntu5","4:5.1.1+dfsg1-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:5.2.1+dfsg-1ubuntu1","4:5.2.1+dfsg-2ubuntu1","4:5.2.1+dfsg-2ubuntu2","4:5.2.1+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:5.2.2-really5.2.2+20250121+dfsg-1","4:5.2.2-really+dfsg-1","4:5.2.2-really+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:5.2.3+dfsg-1","4:5.2.4~dev~git20260809.e0909b211b+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:5.2.2-really+dfsg-2","4:5.2.3+dfsg-1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-bp154.2.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-bp154.2.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.11-bp153.2.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.11-bp153.2.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.11-bp153.2.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-1.1"}]}],"bundled":2}],"products":[{"vendor":"phpmyadmin","product":"phpmyadmin"}],"references":[{"url":"https://www.phpmyadmin.net/security/PMASA-2022-1/","tags":["x_transferred","Patch","Vendor Advisory","advisory","web","report"]},{"url":"https://security.gentoo.org/glsa/202311-17","tags":["vendor-advisory","x_transferred","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23807","tags":["web","advisory"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/ca54f1db050859eb8555875c6aa5d7796fdf4b32","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-8wf2-3ggj-78q9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-23807","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23807.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-23807","tags":["advisory"]},{"url":"https://github.com/phpmyadmin/phpmyadmin","tags":["package"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2022-1","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2022-0036.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29931","tags":["report"]},{"url":"https://www.phpmyadmin.net/news/2022/1/22/phpmyadmin-498-512-and-520-rc1-are-released/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-23807","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23807","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VQ5VVS2CGDQ32RHYLQQZFFFADPEZO6KM/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1195017","tags":["report"]},{"url":"https://bugzilla.suse.com/1195018","tags":["report"]},{"url":"https://bugzilla.suse.com/1197036","tags":["report"]},{"url":"https://bugzilla.suse.com/1208186","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25727","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SIBPCIY36W2XLHJWQUOTE37ZJ4IX6SLB/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1092345","tags":["report"]},{"url":"https://bugzilla.suse.com/1170743","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-23807","description":"An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.","status":"published","published":"2022-01-22T00:00:00Z","modified":"2024-08-03T03:51:46.021Z","updated_at":"2026-11-02T14:34:29.842547Z"}],"euvd":[{"id":"EUVD-2022-0533","description":"An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.","status":"published","published":"2022-01-22T00:00:00Z","modified":"2024-08-03T03:51:46Z","updated_at":"2026-11-03T03:25:50.734887Z"}],"ghsa":[{"id":"GHSA-8wf2-3ggj-78q9","title":"Improper Authentication in phpmyadmin","description":"An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.","status":"published","published":"2022-01-28T22:44:40Z","modified":"2024-04-22T19:09:47Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:37:44.335614Z"}],"nvd":[{"id":"CVE-2022-23807","description":"An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.","status":"published","published":"2022-01-22T02:15:07.15Z","modified":"2026-06-17T04:30:48.81Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:07:11.52734Z"}],"osv":[{"id":"ALPINE-CVE-2022-23807","description":"An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.","status":"published","published":"2022-01-22T02:15:07.15Z","modified":"2026-11-03T07:31:13.125635312Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:50:01.054176Z"},{"id":"DEBIAN-CVE-2022-23807","description":"An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.","status":"published","published":"2022-01-22T02:15:07.15Z","modified":"2026-11-03T08:02:05.999152429Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"GHSA-8wf2-3ggj-78q9","title":"Improper Authentication in phpmyadmin","description":"An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.","status":"published","published":"2022-01-28T22:44:40Z","modified":"2024-04-22T19:26:37.079567Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"UBUNTU-CVE-2022-23807","description":"An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.","status":"published","published":"2022-01-22T02:15:00Z","modified":"2026-10-17T12:56:02.316849558Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"BIT-phpmyadmin-2022-23807","description":"An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.","status":"published","published":"2024-03-06T11:01:48.868Z","modified":"2026-09-08T08:48:24.805082685Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"CVE-2022-23807","description":"An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.","status":"published","published":"2022-01-22T00:00:00Z","modified":"2026-10-28T02:30:47.029619856Z","updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"MGASA-2022-0036","title":"Updated phpmyadmin packages fix security vulnerability","description":"A flaw was identified in how phpMyAdmin processes two factor\nauthentication; a user could potentially manipulate their account to\nbypass two factor authentication in subsequent authentication sessions\n(PMASA-2022-1).\n\nA series of weaknesses was identified allowing a malicious user to submit\nmalicious information to present an XSS or HTML injection attack in the\ngraphical setup page (PMASA-2022-2).\n\nIn some scenarios, potentially sensitive information such as a the\ndatabase name can be part of the URL. This can now be optionally\nencrypted.\n\nDuring a failed log on attempt, the error message reveals the target\ndatabase server's hostname or IP address. This can reveal some\ninformation about the network infrastructure to an attacker.\n\nFixed some situations where a user is logged out when working with more\nthan one server\n\nFixed a problem with assigning privileges to a user using the multiselect\nlist when the database name has an underscore\n\nEnable cookie parameter \"SameSite\" when the PHP version is 7.3 or newer.\n","status":"published","published":"2022-01-25T12:13:11Z","modified":"2026-04-16T04:41:58.523461675Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2023:0047-1","title":"Security update for phpMyAdmin","description":"This update for phpMyAdmin fixes the following issues:\n\nphpMyAdmin was updated to 5.2.1\n\nThis is a security and bufix release.\n\n* Security:\n\n  - Fix (PMASA-2023-01, CWE-661, boo#1208186, CVE-2023-25727) \n    Fix an XSS attack through the drag-and-drop upload feature.\n\n* Bugfixes:\n\n  - issue #17522 Fix case where the routes cache file is invalid\n  - issue #17506 Fix error when configuring 2FA without XMLWriter or Imagick\n  - issue        Fix blank page when some error occurs\n  - issue #17519 Fix Export pages not working in certain conditions\n  - issue #17496 Fix error in table operation page when partitions are broken\n  - issue #17386 Fix system memory and system swap values on Windows\n  - issue #17517 Fix Database Server panel not getting hidden by ShowServerInfo configuration directive\n  - issue #17271 Fix database names not showing on Processes tab\n  - issue #17424 Fix export limit size calculation\n  - issue #17366 Fix refresh rate popup on Monitor page\n  - issue #17577 Fix monitor charts size on RTL languages\n  - issue #17121 Fix password_hash function incorrectly adding single quotes to password before hashing\n  - issue #17586 Fix statistics not showing for empty databases\n  - issue #17592 Clicking on the New index link on the sidebar does not throw an error anymore\n  - issue #17584 It's now possible to browse a database that includes two % in its name\n  - issue        Fix PHP 8.2 deprecated string interpolation syntax\n  - issue        Some languages are now correctly detected from the HTTP header\n  - issue #17617 Sorting is correctly remembered when $cfg['RememberSorting'] is true\n  - issue #17593 Table filtering now works when action buttons are on the right side of the row\n  - issue #17388 Find and Replace using regex now makes a valid query if no matching result set found\n  - issue #17551 Enum/Set editor will not fail to open when creating a new column\n  - issue #17659 Fix error when a database group is named tables, views, functions, procedures or events\n  - issue #17673 Allow empty values to be inserted into columns\n  - issue #17620 Fix error handling at phpMyAdmin startup for the JS SQL console\n  - issue        Fixed debug queries console broken UI for query time and group count\n  - issue        Fixed escaping of SQL query and errors for the debug console\n  - issue        Fix console toolbar UI when the bookmark feature is disabled and sql debug is enabled\n  - issue #17543 Fix JS error on saving a new designer page\n  - issue #17546 Fix JS error after using save as and open page operation on the designer\n  - issue        Fix PHP warning on GIS visualization when there is only one GIS column\n  - issue #17728 Some select HTML tags will now have the correct UI style\n  - issue #17734 PHP deprecations will only be shown when in a development environment\n  - issue #17369 Fix server error when blowfish_secret is not exactly 32 bytes long\n  - issue #17736 Add utf8mb3 as an alias of utf8 on the charset description page\n  - issue #16418 Fix FAQ 1.44 about manually removing vendor folders\n  - issue #12359 Setup page now sends the Content-Security-Policy headers\n  - issue #17747 The Column Visibility Toggle will not be hidden by other elements\n  - issue #17756 Edit/Copy/Delete row now works when using GROUP BY\n  - issue #17248 Support the UUID data type for MariaDB \u003e= 10.7\n  - issue #17656 Fix replace/change/set table prefix is not working\n  - issue        Fix monitor page filter queries only filtering the first row\n  - issue        Fix 'Link not found!' on foreign columns for tables having no char column to show\n  - issue #17390 Fix 'Create view' modal doesn't show on results and empty results\n  - issue #17772 Fix wrong styles for add button from central columns\n  - issue #17389 Fix HTML disappears when exporting settings to browser's storage\n  - issue #17166 Fix 'Warning: #1287 'X' is deprecated [...] Please use ST_X instead.' on search page\n  - issue        Use jquery-migrate.min.js (14KB) instead of jquery-migrate.min.js (31KB)\n  - issue #17842 Use jquery.validate.min.js (24 KB) instead of jquery.validate.js (50 KB)\n  - issue #17281 Fix links to databases for information_schema.SCHEMATA\n  - issue #17553 Fix Metro theme unreadable links above navigation tree\n  - issue #17553 Metro theme UI fixes and improvements\n  - issue #17553 Fix Metro theme login form with\n  - issue #16042 Exported gzip file of database has first ~73 kB uncompressed and rest is gzip compressed in Firefox\n  - issue #17705 Fix inline SQL query edit FK checkbox preventing submit buttons from working\n  - issue #17777 Fix Uncaught TypeError: Cannot read properties of null (reading 'inline') on datepickers when re-opened\n  - issue        Fix Original theme buttons style and login form width\n  - issue #17892 Fix closing index edit modal and reopening causes it to fire twice\n  - issue #17606 Fix preview SQL modal not working inside 'Add Index' modal\n  - issue        Fix PHP error on adding new column on create table form\n  - issue #17482 Default to 'Full texts' when running explain statements\n  - issue        Fixed Chrome scrolling performance issue on a textarea of an 'export as text' page\n  - issue #17703 Fix datepicker appears on all fields, not just date\n  - issue        Fix space in the tree line when a DB is expanded\n  - issue #17340 Fix 'New Table' page -\u003e 'VIRTUAL' attribute is lost when adding a new column\n  - issue #17446 Fix missing option for STORED virtual column on MySQL and PERSISTENT is not supported on MySQL\n  - issue #17446 Lower the check for virtual columns to MySQL\u003e=5.7.6 nothing is supported on 5.7.5\n  - issue        Fix column names option for CSV Export\n  - issue #17177 Fix preview SQL when reordering columns doesn't work on move columns\n  - issue #15887 Fixed DROP TABLE errors ignored on multi table select for DROP\n  - issue #17944 Fix unable to create a view from tree view button\n  - issue #17927 Fix key navigation between select inputs (drop an old Firefox workaround)\n  - issue #17967 Fix missing icon for collapse all button\n  - issue #18006 Fixed UUID columns can't be moved\n  - issue        Add `spellcheck='false'` to all password fields and some text fields to avoid spell-jacking data leaks\n  - issue        Remove non working 'Analyze Explain at MariaDB.org' button (MariaDB stopped this service)\n  - issue #17229 Add support for Web Authentication API because Chrome removed support for the U2F API\n  - issue #18019 Fix 'Call to a member function fetchAssoc() on bool' with SQL mode ONLY_FULL_GROUP_BY on monitor search logs\n  - issue        Add back UUID and UUID_SHORT to functions on MySQL and all MariaDB versions\n  - issue #17398 Fix clicking on JSON columns triggers update query\n  - issue        Fix silent JSON parse error on upload progress\n  - issue #17833 Fix 'Add Parameter' button not working for Add Routine Screen\n  - issue #17365 Fixed 'Uncaught Error: regexp too big' on server status variables page\n\nUpdate to 5.2.0\n\n* Bugfix\n\n  - issue #16521 Upgrade Bootstrap to version 5\n  - issue #16521 Drop support for Internet Explorer and others\n  - issue        Upgrade to shapefile 3\n  - issue #16555 Bump minimum PHP version to 7.2\n  - issue        Remove the phpseclib dependency\n  - issue        Upgrade Symfony components to version 5.2\n  - issue        Upgrade to Motranslator 4\n  - issue #16005 Improve the performance of the Export logic\n  - issue #16829 Add NOT LIKE %...% operator to Table search\n  - issue #16845 Fixed some links not passing through url.php\n  - issue #16382 Remove apc upload progress method (all upload progress code was removed from the PHP extension)\n  - issue #16974 Replace zxcvbn by zxcvbn-ts\n  - issue #15691 Disable the last column checkbox in the column list dropdown instead of not allowing un-check\n  - issue #16138 Ignore the length of integer types and show a warning on MySQL \u003e= 8.0.18\n  - issue        Add support for the Mroonga engine\n  - issue        Double click column name to directly copy to clipboard\n  - issue #16425 Add DELETE FROM table on table operations page\n  - issue #16482 Add a select all link for table-specific privileges\n  - issue #14276 Add support for account locking\n  - issue #17143 Use composer/ca-bundle to manage the CA cert file\n  - issue #17143 Require the openssl PHP extension\n  - issue #17171 Remove the printview.css file from themes\n  - issue #17203 Redesign the export and the import pages\n  - issue #16197 Replace the master/slave terminology\n  - issue #17257 Replace libraries/vendor_config.php constants with an array\n  - issue        Add the Bootstrap theme\n  - issue #17499 Remove stickyfilljs JavaScript dependency\n\nUpdate to 5.1.3\n\nThis is a security and bufix release.\n\n* Security\n\n  - Fix for boo#1197036 (CVE-2022-0813)\n  - Fix for path disclosure under certain server configurations\n    (if display_errors is on, for instance)\n\n* Bugfix\n\n  - issue #17308 Fix broken pagination links in the navigation sidebar\n  - issue #17331 Fix MariaDB has no support for system variable 'disabled_storage_engines'\n  - issue #17315 Fix unsupported operand types in Results.php when running 'SHOW PROCESSLIST' SQL query\n  - issue #17288 Fixed importing browser settings question box after login when having no pmadb\n  - issue #17288 Fix 'First day of calendar' user override has no effect\n  - issue #17239 Fixed repeating headers are not working\n  - issue #17298 Fixed import of email-adresses or links from ODS results in empty contents\n  - issue #17344 Fixed a type error on ODS import with non string values\n  - issue #17239 Fixed header row show/hide columns buttons on each line after hover are shown on each row\n\nUpdate to 5.1.2\n\nThis is a security and bufix release.\n\n* Security\n\n  - Fix boo#1195017 (CVE-2022-23807, PMASA-2022-1, CWE-661) \n    Two factor authentication bypass\n  - Fix boo#1195018 (CVE-2022-23808, PMASA-2022-2, CWE-661)\n    Multiple XSS and HTML injection attacks in setup script\n\n* Bugfixes\n\n  - Revert a changed to $cfg['CharTextareaRows'] allow values\n    less than 7\n  - Fix encoding of enum and set values on edit value\n  - Fixed possible 'Undefined index: clause_is_unique' error\n  - Fixed some situations where a user is logged out when working\n    with more than one server\n  - Fixed a problem with assigning privileges to a user using the\n    multiselect list when the database name has an underscore\n  - Enable cookie parameter 'SameSite' when the PHP version\n    is 7.3 or newer\n  - Correctly handle the removal of 'innodb_file_format' in\n    MariaDB and MySQL\n\n","status":"published","published":"2023-02-15T10:21:02Z","modified":"2025-05-07T18:13:32.484393Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2023:0154-1","title":"Security update for phpMyAdmin","description":"This update for phpMyAdmin fixes the following issues:\n\nUpdate to 4.9.11:\n\n- CVE-2023-25727: Fixed XSS vulnerability in drag-and-drop upload (boo#1208186).\n","status":"published","published":"2023-06-27T17:51:34Z","modified":"2026-02-04T03:07:16.357785Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11765-1","title":"phpMyAdmin-5.1.2-1.1 on GA media","description":"These are all security issues fixed in the phpMyAdmin-5.1.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:20:50.187971Z","updated_at":"2026-11-02T16:58:35.195147Z"}]}}