FreshPorts - VuXML

phpMyAdmin reports:

Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.

< 2.11.9.5

< 3.1.3.1

phpMyAdmin Team reports:

It was possible to conduct a XSS attack using crafted URLs org POST parameters on several pages.

< 3.3.5.1

< 2.11.10.1

phpMyAdmin Team reports:

Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted MySQL table name.

SQL injection vulnerability allows remote attackers to inject SQL via various interface parameters of the PDF schema generator feature.

< 3.2.2.1

< 2.11.9.6

The phpMyAdmin Team reports:

A logged-in user can be subject of SQL injection through cross site request forgery. Several scripts in phpMyAdmin are vulnerable and the attack can be made through table parameter.

< 2.11.9.4

< 3.1.1

phpMyAdmin team reports:

It was possible to conduct a XSS attack using spoofed request on the db search script.

< 3.3.8.1

< 2.11.11.1

SecurityFocus reports:

phpMyAdmin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

gt 3.0 lt 3.0.1.1

< 2.11.9.3

< 2.11.9.3

phpMyAdmin team reports:

It was possible to create a bookmark which would be executed unintentionally by other users.

When the files README, ChangeLog or LICENSE have been removed from their original place (possibly by the distributor), the scripts used to display these files can show their full path, leading to possible further attacks.

< 3.3.9.2

< 2.11.11.3