[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPcbX_HbCqZf3Y_FRX0U5p4PWXponpLTRc-YXHzqhlR8":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":18,"kevVulnerabilities":82,"topProductsByCves":88,"seoMetadata":90,"meta":99},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":9,"versionCount":11,"lastCveUpdate":12,"firstLetter":13,"products":14,"description":17},24552,"phpmyadmin",1,270,470,"2023-02-13","p",[15],{"id":16,"product_name":8,"version_count":11,"cve_count":10,"kev_count":9,"last_cve_update":12},128710,"Phpmyadmin is a technology vendor with 1 tracked product and 270 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[19,28,35,41,48,53,58,65,70,76],{"cveId":20,"description":21,"publishedDate":22,"cvssScore":23,"cvssVersion":24,"severity":25,"isKev":26,"epssScore":27},"CVE-2018-12613","An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the \"$cfg['AllowArbitraryServer'] = true\" case (where an attacker can specify any host he\u002Fshe is already in control of, and execute arbitrary code on phpMyAdmin) and the \"$cfg['ServerDefault'] = 0\" case (which bypasses the login requirement and runs the vulnerable code without any authentication).","2018-06-21",8.8,"v3.1","High",false,0.9835,{"cveId":29,"description":30,"publishedDate":31,"cvssScore":32,"cvssVersion":24,"severity":33,"isKev":4,"epssScore":34},"CVE-2009-1151","Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.","2009-03-26",9.8,"Critical",0.96565,{"cveId":36,"description":37,"publishedDate":38,"cvssScore":32,"cvssVersion":39,"severity":33,"isKev":26,"epssScore":40},"CVE-2016-5734","phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.","2016-07-03","v3.0",0.81373,{"cveId":42,"description":43,"publishedDate":44,"cvssScore":45,"cvssVersion":46,"severity":25,"isKev":26,"epssScore":47},"CVE-2012-5159","phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modification (Trojan Horse) in server_sync.php, which allows remote attackers to execute arbitrary PHP code via an eval injection attack.","2012-09-25",7.5,"v2",0.74515,{"cveId":49,"description":50,"publishedDate":51,"cvssScore":32,"cvssVersion":24,"severity":33,"isKev":26,"epssScore":52},"CVE-2020-26935","An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.","2020-10-10",0.67081,{"cveId":54,"description":55,"publishedDate":56,"cvssScore":23,"cvssVersion":24,"severity":25,"isKev":26,"epssScore":57},"CVE-2020-5504","In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.","2020-01-09",0.38778,{"cveId":59,"description":60,"publishedDate":61,"cvssScore":62,"cvssVersion":46,"severity":63,"isKev":26,"epssScore":64},"CVE-2013-3238","phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a \u002Fe\\x00 sequence, which is not properly handled before making a preg_replace function call within the \"Replace table prefix\" feature.","2013-04-26",6,"Medium",0.28851,{"cveId":66,"description":67,"publishedDate":68,"cvssScore":45,"cvssVersion":46,"severity":25,"isKev":26,"epssScore":69},"CVE-2012-5469","The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console access via a direct request to wp-content\u002Fplugins\u002Fportable-phpmyadmin\u002Fwp-pma-mod.","2012-12-20",0.23745,{"cveId":71,"description":72,"publishedDate":73,"cvssScore":74,"cvssVersion":39,"severity":63,"isKev":26,"epssScore":75},"CVE-2019-12616","An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken \u003Cimg> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim.","2019-06-05",6.5,0.19184,{"cveId":77,"description":78,"publishedDate":79,"cvssScore":80,"cvssVersion":46,"severity":63,"isKev":26,"epssScore":81},"CVE-2005-3299","PHP file inclusion vulnerability in grab_globals.lib.php in phpMyAdmin 2.6.4 and 2.6.4-pl1 allows remote attackers to include local files via the $__redirect parameter, possibly involving the subform array.","2005-10-23",5,0.15919,[83],{"cveId":29,"description":30,"publishedDate":31,"cvssScore":32,"cvssVersion":24,"severity":33,"isKev":4,"epssScore":34,"cisaVulnName":84,"cisaDateAdded":85,"cisaShortDescription":86,"cisaRequiredAction":87},"phpMyAdmin Remote Code Execution Vulnerability","2022-03-25","Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.","Apply updates per vendor instructions.",[89],{"id":16,"product_name":8,"version_count":11,"cve_count":10,"kev_count":9,"last_cve_update":12},{"title":91,"metaDescription":92,"keywords":93,"structuredData":94},"Phpmyadmin - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Phpmyadmin covering 1 product with 270 tracked vulnerabilities including 1 critical and 0 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Phpmyadmin vulnerabilities, Phpmyadmin security, Phpmyadmin CVE, Phpmyadmin threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Phpmyadmin KEV, Phpmyadmin exploited vulnerabilities",{"@context":95,"@type":96,"name":97,"description":92,"url":98},"https:\u002F\u002Fschema.org","Organization","Phpmyadmin","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fphpmyadmin",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":9,"lastUpdated":12,"generatedAt":100,"apiVersion":101},"2026-10-17T03:38:33.674Z","3.0"]