{"id":"CVE-2023-25727","aliases":["BIT-phpmyadmin-2023-25727","DEBIAN-CVE-2023-25727","DLA-4121-1","EUVD-2023-0641","GHSA-6hr3-44gx-g6wh","UBUNTU-CVE-2023-25727","openSUSE-SU-2023:0047-1","openSUSE-SU-2023:0058-1","openSUSE-SU-2023:0154-1","openSUSE-SU-2024:12689-1"],"status":"published","title":"Cross-site Scripting vulnerability in drag-and-drop upload of phpMyAdmin","description":"In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01163,"percentile":0.67659,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-02-13T00:00:00Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","fixed_in":["4.9.11","5.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"phpmyadmin","fixed_in":["4.9.11","5.2.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"phpmyadmin","fixed_in":["4:5.2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"phpmyadmin","fixed_in":["4:5.2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"phpmyadmin","fixed_in":["4:5.2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 12","package":"phpMyAdmin","fixed_in":["4.9.11-58.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"phpMyAdmin","fixed_in":["5.2.1-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.9.11"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.2.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"phpmyadmin","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.9.11"},{"introduced":"5.0.0"},{"fixed":"5.2.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.0.4+dfsg2-2+deb11u2"}]}],"versions":["4:5.0.4+dfsg2-2","4:5.0.4+dfsg2-2+deb11u1"],"bundled":3},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.9.11"}]}],"versions":["4.7.0","4.7.1","4.7.2","4.7.3","4.7.4","4.7.5","4.7.6","4.7.7","4.7.8","4.7.9","4.8.0","4.8.0.1","4.8.1","4.8.2","4.8.3","4.8.4","4.8.5","4.9.0","4.9.0.1","4.9.1","4.9.10","4.9.2","4.9.3","4.9.4","4.9.5","4.9.6","4.9.7","4.9.8","4.9.9"]},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.2.1"}]}],"versions":["5.0.0","5.0.0.1","5.0.1","5.0.2","5.0.3","5.0.4","5.1.0","5.1.1","5.1.2","5.1.3","5.1.4","5.2.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.0.6-1","4:4.0.8-1","4:4.0.9-1","4:4.0.10-1","4:4.0.10-1ubuntu0.1","4:4.0.10-1ubuntu0.1+esm1","4:4.0.10-1ubuntu0.1+esm2","4:4.0.10-1ubuntu0.1+esm3","4:4.0.10-1ubuntu0.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.4.13.1-1","4:4.5.0.2-2","4:4.5.1-1","4:4.5.1-2","4:4.5.1-3","4:4.5.2-1","4:4.5.2-2","4:4.5.3.1-1","4:4.5.4-1","4:4.5.4.1-2","4:4.5.4.1-2ubuntu1","4:4.5.4.1-2ubuntu2","4:4.5.4.1-2ubuntu2.1","4:4.5.4.1-2ubuntu2.1+esm2","4:4.5.4.1-2ubuntu2.1+esm3","4:4.5.4.1-2ubuntu2.1+esm4","4:4.5.4.1-2ubuntu2.1+esm5","4:4.5.4.1-2ubuntu2.1+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.6.6-5","4:4.6.6-5ubuntu0.2+esm1","4:4.6.6-5ubuntu0.2+esm2","4:4.6.6-5ubuntu0.5","4:4.6.6-5ubuntu0.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.9.1+dfsg1-2","4:4.9.2+dfsg1-1","4:4.9.5+dfsg1-1ubuntu1","4:4.9.5+dfsg1-2","4:4.9.5+dfsg1-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:5.0.4+dfsg2-2ubuntu5","4:5.1.1+dfsg1-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:5.2.1+dfsg-1ubuntu1","4:5.2.1+dfsg-2ubuntu1","4:5.2.1+dfsg-2ubuntu2","4:5.2.1+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:5.2.2-really5.2.2+20250121+dfsg-1","4:5.2.2-really+dfsg-1","4:5.2.2-really+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:5.2.3+dfsg-1","4:5.2.4~dev~git20260809.e0909b211b+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:5.2.2-really+dfsg-2","4:5.2.3+dfsg-1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-bp154.2.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-bp154.2.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.11-58.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.11-bp153.2.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.11-bp153.2.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.11-bp153.2.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-2.1"}]}]}],"products":[{"vendor":"phpmyadmin","product":"phpmyadmin"}],"references":[{"url":"https://www.phpmyadmin.net/security/PMASA-2023-1/","tags":["x_transferred","Patch","Vendor Advisory","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00016.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25727","tags":["web","advisory"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/53f70fd7f3b388639922e6cc1ca51fbe890c91cc","tags":["web"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/efa2406695551667f726497750d3db91fb6f662e","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2023-1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6hr3-44gx-g6wh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25727.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-25727","tags":["advisory"]},{"url":"https://github.com/phpmyadmin/composer","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-25727","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25727","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VQ5VVS2CGDQ32RHYLQQZFFFADPEZO6KM/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1195017","tags":["report"]},{"url":"https://bugzilla.suse.com/1195018","tags":["report"]},{"url":"https://bugzilla.suse.com/1197036","tags":["report"]},{"url":"https://bugzilla.suse.com/1208186","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25727","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KQHBFWTBGODCBAQAKP2FMAYMJ2P7EKFE/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SIBPCIY36W2XLHJWQUOTE37ZJ4IX6SLB/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1092345","tags":["report"]},{"url":"https://bugzilla.suse.com/1170743","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-25727","description":"In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.","status":"published","published":"2023-02-13T00:00:00Z","modified":"2025-11-03T19:28:04.349Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:19.959682Z"}],"euvd":[{"id":"EUVD-2023-0641","description":"In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.","status":"published","published":"2023-02-13T00:00:00Z","modified":"2025-11-03T19:28:04Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:34.152725Z"}],"ghsa":[{"id":"GHSA-6hr3-44gx-g6wh","title":"Cross-site Scripting vulnerability in drag-and-drop upload of phpMyAdmin","description":"In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger Cross-site Scripting (XSS) by uploading a crafted .sql file through the drag-and-drop interface. By disabling the configuration directive `$cfg['enable_drag_drop_import']`, users will be unable to use the drag and drop upload which would protect against the vulnerability.","status":"published","published":"2023-02-13T06:30:59Z","modified":"2025-03-21T15:36:53Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:35.74197Z"}],"nvd":[{"id":"CVE-2023-25727","description":"In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.","status":"published","published":"2023-02-13T06:15:11.083Z","modified":"2026-06-17T05:41:49.38Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:46.811196Z"}],"osv":[{"id":"CVE-2023-25727","description":"In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.","status":"published","published":"2023-02-13T00:00:00Z","modified":"2026-10-28T02:30:39.050858173Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"DEBIAN-CVE-2023-25727","description":"In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.","status":"published","published":"2023-02-13T06:15:11.083Z","modified":"2026-10-26T18:00:38.198115907Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"GHSA-6hr3-44gx-g6wh","title":"Cross-site Scripting vulnerability in drag-and-drop upload of phpMyAdmin","description":"In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger Cross-site Scripting (XSS) by uploading a crafted .sql file through the drag-and-drop interface. By disabling the configuration directive `$cfg['enable_drag_drop_import']`, users will be unable to use the drag and drop upload which would protect against the vulnerability.","status":"published","published":"2023-02-13T06:30:59Z","modified":"2025-03-21T15:52:59.263497Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"UBUNTU-CVE-2023-25727","description":"In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.","status":"published","published":"2023-02-13T06:15:00Z","modified":"2026-10-17T12:56:05.342658592Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"BIT-phpmyadmin-2023-25727","description":"In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.","status":"published","published":"2024-03-06T11:01:27.502Z","modified":"2026-09-08T08:48:24.79993064Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"DLA-4121-1","title":"phpmyadmin - security update","status":"published","published":"2025-04-08T00:00:00Z","modified":"2026-03-09T01:19:57.926229Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"openSUSE-SU-2023:0047-1","title":"Security update for phpMyAdmin","description":"This update for phpMyAdmin fixes the following issues:\n\nphpMyAdmin was updated to 5.2.1\n\nThis is a security and bufix release.\n\n* Security:\n\n  - Fix (PMASA-2023-01, CWE-661, boo#1208186, CVE-2023-25727) \n    Fix an XSS attack through the drag-and-drop upload feature.\n\n* Bugfixes:\n\n  - issue #17522 Fix case where the routes cache file is invalid\n  - issue #17506 Fix error when configuring 2FA without XMLWriter or Imagick\n  - issue        Fix blank page when some error occurs\n  - issue #17519 Fix Export pages not working in certain conditions\n  - issue #17496 Fix error in table operation page when partitions are broken\n  - issue #17386 Fix system memory and system swap values on Windows\n  - issue #17517 Fix Database Server panel not getting hidden by ShowServerInfo configuration directive\n  - issue #17271 Fix database names not showing on Processes tab\n  - issue #17424 Fix export limit size calculation\n  - issue #17366 Fix refresh rate popup on Monitor page\n  - issue #17577 Fix monitor charts size on RTL languages\n  - issue #17121 Fix password_hash function incorrectly adding single quotes to password before hashing\n  - issue #17586 Fix statistics not showing for empty databases\n  - issue #17592 Clicking on the New index link on the sidebar does not throw an error anymore\n  - issue #17584 It's now possible to browse a database that includes two % in its name\n  - issue        Fix PHP 8.2 deprecated string interpolation syntax\n  - issue        Some languages are now correctly detected from the HTTP header\n  - issue #17617 Sorting is correctly remembered when $cfg['RememberSorting'] is true\n  - issue #17593 Table filtering now works when action buttons are on the right side of the row\n  - issue #17388 Find and Replace using regex now makes a valid query if no matching result set found\n  - issue #17551 Enum/Set editor will not fail to open when creating a new column\n  - issue #17659 Fix error when a database group is named tables, views, functions, procedures or events\n  - issue #17673 Allow empty values to be inserted into columns\n  - issue #17620 Fix error handling at phpMyAdmin startup for the JS SQL console\n  - issue        Fixed debug queries console broken UI for query time and group count\n  - issue        Fixed escaping of SQL query and errors for the debug console\n  - issue        Fix console toolbar UI when the bookmark feature is disabled and sql debug is enabled\n  - issue #17543 Fix JS error on saving a new designer page\n  - issue #17546 Fix JS error after using save as and open page operation on the designer\n  - issue        Fix PHP warning on GIS visualization when there is only one GIS column\n  - issue #17728 Some select HTML tags will now have the correct UI style\n  - issue #17734 PHP deprecations will only be shown when in a development environment\n  - issue #17369 Fix server error when blowfish_secret is not exactly 32 bytes long\n  - issue #17736 Add utf8mb3 as an alias of utf8 on the charset description page\n  - issue #16418 Fix FAQ 1.44 about manually removing vendor folders\n  - issue #12359 Setup page now sends the Content-Security-Policy headers\n  - issue #17747 The Column Visibility Toggle will not be hidden by other elements\n  - issue #17756 Edit/Copy/Delete row now works when using GROUP BY\n  - issue #17248 Support the UUID data type for MariaDB \u003e= 10.7\n  - issue #17656 Fix replace/change/set table prefix is not working\n  - issue        Fix monitor page filter queries only filtering the first row\n  - issue        Fix 'Link not found!' on foreign columns for tables having no char column to show\n  - issue #17390 Fix 'Create view' modal doesn't show on results and empty results\n  - issue #17772 Fix wrong styles for add button from central columns\n  - issue #17389 Fix HTML disappears when exporting settings to browser's storage\n  - issue #17166 Fix 'Warning: #1287 'X' is deprecated [...] Please use ST_X instead.' on search page\n  - issue        Use jquery-migrate.min.js (14KB) instead of jquery-migrate.min.js (31KB)\n  - issue #17842 Use jquery.validate.min.js (24 KB) instead of jquery.validate.js (50 KB)\n  - issue #17281 Fix links to databases for information_schema.SCHEMATA\n  - issue #17553 Fix Metro theme unreadable links above navigation tree\n  - issue #17553 Metro theme UI fixes and improvements\n  - issue #17553 Fix Metro theme login form with\n  - issue #16042 Exported gzip file of database has first ~73 kB uncompressed and rest is gzip compressed in Firefox\n  - issue #17705 Fix inline SQL query edit FK checkbox preventing submit buttons from working\n  - issue #17777 Fix Uncaught TypeError: Cannot read properties of null (reading 'inline') on datepickers when re-opened\n  - issue        Fix Original theme buttons style and login form width\n  - issue #17892 Fix closing index edit modal and reopening causes it to fire twice\n  - issue #17606 Fix preview SQL modal not working inside 'Add Index' modal\n  - issue        Fix PHP error on adding new column on create table form\n  - issue #17482 Default to 'Full texts' when running explain statements\n  - issue        Fixed Chrome scrolling performance issue on a textarea of an 'export as text' page\n  - issue #17703 Fix datepicker appears on all fields, not just date\n  - issue        Fix space in the tree line when a DB is expanded\n  - issue #17340 Fix 'New Table' page -\u003e 'VIRTUAL' attribute is lost when adding a new column\n  - issue #17446 Fix missing option for STORED virtual column on MySQL and PERSISTENT is not supported on MySQL\n  - issue #17446 Lower the check for virtual columns to MySQL\u003e=5.7.6 nothing is supported on 5.7.5\n  - issue        Fix column names option for CSV Export\n  - issue #17177 Fix preview SQL when reordering columns doesn't work on move columns\n  - issue #15887 Fixed DROP TABLE errors ignored on multi table select for DROP\n  - issue #17944 Fix unable to create a view from tree view button\n  - issue #17927 Fix key navigation between select inputs (drop an old Firefox workaround)\n  - issue #17967 Fix missing icon for collapse all button\n  - issue #18006 Fixed UUID columns can't be moved\n  - issue        Add `spellcheck='false'` to all password fields and some text fields to avoid spell-jacking data leaks\n  - issue        Remove non working 'Analyze Explain at MariaDB.org' button (MariaDB stopped this service)\n  - issue #17229 Add support for Web Authentication API because Chrome removed support for the U2F API\n  - issue #18019 Fix 'Call to a member function fetchAssoc() on bool' with SQL mode ONLY_FULL_GROUP_BY on monitor search logs\n  - issue        Add back UUID and UUID_SHORT to functions on MySQL and all MariaDB versions\n  - issue #17398 Fix clicking on JSON columns triggers update query\n  - issue        Fix silent JSON parse error on upload progress\n  - issue #17833 Fix 'Add Parameter' button not working for Add Routine Screen\n  - issue #17365 Fixed 'Uncaught Error: regexp too big' on server status variables page\n\nUpdate to 5.2.0\n\n* Bugfix\n\n  - issue #16521 Upgrade Bootstrap to version 5\n  - issue #16521 Drop support for Internet Explorer and others\n  - issue        Upgrade to shapefile 3\n  - issue #16555 Bump minimum PHP version to 7.2\n  - issue        Remove the phpseclib dependency\n  - issue        Upgrade Symfony components to version 5.2\n  - issue        Upgrade to Motranslator 4\n  - issue #16005 Improve the performance of the Export logic\n  - issue #16829 Add NOT LIKE %...% operator to Table search\n  - issue #16845 Fixed some links not passing through url.php\n  - issue #16382 Remove apc upload progress method (all upload progress code was removed from the PHP extension)\n  - issue #16974 Replace zxcvbn by zxcvbn-ts\n  - issue #15691 Disable the last column checkbox in the column list dropdown instead of not allowing un-check\n  - issue #16138 Ignore the length of integer types and show a warning on MySQL \u003e= 8.0.18\n  - issue        Add support for the Mroonga engine\n  - issue        Double click column name to directly copy to clipboard\n  - issue #16425 Add DELETE FROM table on table operations page\n  - issue #16482 Add a select all link for table-specific privileges\n  - issue #14276 Add support for account locking\n  - issue #17143 Use composer/ca-bundle to manage the CA cert file\n  - issue #17143 Require the openssl PHP extension\n  - issue #17171 Remove the printview.css file from themes\n  - issue #17203 Redesign the export and the import pages\n  - issue #16197 Replace the master/slave terminology\n  - issue #17257 Replace libraries/vendor_config.php constants with an array\n  - issue        Add the Bootstrap theme\n  - issue #17499 Remove stickyfilljs JavaScript dependency\n\nUpdate to 5.1.3\n\nThis is a security and bufix release.\n\n* Security\n\n  - Fix for boo#1197036 (CVE-2022-0813)\n  - Fix for path disclosure under certain server configurations\n    (if display_errors is on, for instance)\n\n* Bugfix\n\n  - issue #17308 Fix broken pagination links in the navigation sidebar\n  - issue #17331 Fix MariaDB has no support for system variable 'disabled_storage_engines'\n  - issue #17315 Fix unsupported operand types in Results.php when running 'SHOW PROCESSLIST' SQL query\n  - issue #17288 Fixed importing browser settings question box after login when having no pmadb\n  - issue #17288 Fix 'First day of calendar' user override has no effect\n  - issue #17239 Fixed repeating headers are not working\n  - issue #17298 Fixed import of email-adresses or links from ODS results in empty contents\n  - issue #17344 Fixed a type error on ODS import with non string values\n  - issue #17239 Fixed header row show/hide columns buttons on each line after hover are shown on each row\n\nUpdate to 5.1.2\n\nThis is a security and bufix release.\n\n* Security\n\n  - Fix boo#1195017 (CVE-2022-23807, PMASA-2022-1, CWE-661) \n    Two factor authentication bypass\n  - Fix boo#1195018 (CVE-2022-23808, PMASA-2022-2, CWE-661)\n    Multiple XSS and HTML injection attacks in setup script\n\n* Bugfixes\n\n  - Revert a changed to $cfg['CharTextareaRows'] allow values\n    less than 7\n  - Fix encoding of enum and set values on edit value\n  - Fixed possible 'Undefined index: clause_is_unique' error\n  - Fixed some situations where a user is logged out when working\n    with more than one server\n  - Fixed a problem with assigning privileges to a user using the\n    multiselect list when the database name has an underscore\n  - Enable cookie parameter 'SameSite' when the PHP version\n    is 7.3 or newer\n  - Correctly handle the removal of 'innodb_file_format' in\n    MariaDB and MySQL\n\n","status":"published","published":"2023-02-15T10:21:02Z","modified":"2025-05-07T18:13:32.484393Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2023:0058-1","title":"Security update for phpMyAdmin","description":"This update for phpMyAdmin fixes the following issues:\n\nUpdate to 4.9.11:\n\n* Fix an XSS attack through the drag-and-drop upload feature\n  (PMASA-2023-01, CWE-661, boo#1208186, CVE-2023-25727) \n* Fix broken pagination links in the navigation sidebar\n* Fix syntax error for PHP 5\n* Fix hide_connection_errors being undefined when a controluser is set\n","status":"published","published":"2023-02-22T13:26:27Z","modified":"2026-02-04T02:51:53.106091Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2023:0154-1","title":"Security update for phpMyAdmin","description":"This update for phpMyAdmin fixes the following issues:\n\nUpdate to 4.9.11:\n\n- CVE-2023-25727: Fixed XSS vulnerability in drag-and-drop upload (boo#1208186).\n","status":"published","published":"2023-06-27T17:51:34Z","modified":"2026-02-04T03:07:16.357785Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12689-1","title":"phpMyAdmin-5.2.1-2.1 on GA media","description":"These are all security issues fixed in the phpMyAdmin-5.2.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:04:46.824737Z","updated_at":"2026-11-02T16:58:35.751245Z"}]}}