5.3Mittel

CVE-2022-0813PhpMyAdmin exposure of sensitive information

phpMyAdmin phpMyAdmin Veröffentlicht: 2022-03-09 17:59 (vor 4 Jahren)

Beschreibung

PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.

Schwachstellentyp (CWE): CWE-200

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
phpMyAdmin	phpMyAdmin	5.1.1 – ≤ 5.1.1

Referenzen und Patches

CVSS-Score

5.3Mittel

Quelle: INCIBE · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Niedrig
Integrität: Keine
Verfügbarkeit: Keine

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

1.30%

höher als 71 % aller CVEs

Zeitverlauf

ID reserviert2022-03-01
Veröffentlicht2022-03-09 17:59
Bei IP-DB eingegangen2026-10-24 23:38
Zuletzt aktualisiert2024-09-17 02:51

Vergeben von (CNA): INCIBE

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — phpMyAdmin

5.4Mittel

CVE-2026-119563 vor 12 Tagen

phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name

phpMyAdmin phpMyAdmin

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name contains HTML marku…

4.2Mittel

CVE-2026-119562 vor 12 Tagen

phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute

phpMyAdmin phpMyAdmin

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT an…

6.8Mittel

CVE-2026-119561 vor 12 Tagen

phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer

phpMyAdmin phpMyAdmin

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST…

3.7Niedrig

CVE-2026-119428 vor 12 Tagen

phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled

phpMyAdmin phpMyAdmin

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port …

4.3Mittel

CVE-2026-119429 vor 12 Tagen

phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set

phpMyAdmin phpMyAdmin

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON…

4.2Mittel

CVE-2026-119427 vor 12 Tagen

phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting

phpMyAdmin phpMyAdmin

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value…