6.4Medium

CVE-2025-24529

phpMyAdmin phpMyAdmin Published: 2025-01-23 03:00 (1 year ago)

Description

An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the Insert tab.

Weakness (CWE): CWE-79

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
phpMyAdmin	phpMyAdmin	5.0.0 – < 5.2.2

References and patches

CVSS score

6.4Medium

Source: mitre · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

All scores (2)

cna	CVSS 3.1	6.4Medium
cve@mitre.org	CVSS 3.1	6.4Medium

EPSS (chance of exploitation in 30 days)

0.40%

higher than 35% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2025-01-23
Published2025-01-23 03:00
Reached IP-DB2026-10-24 23:58
Last updated2026-06-17 11:59

Assigned by (CNA): mitre
NVD status: Deferred

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — phpMyAdmin

5.4Medium

CVE-2026-119563 14 days ago

phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name

phpMyAdmin phpMyAdmin

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name contains HTML marku…

4.2Medium

CVE-2026-119562 14 days ago

phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute

phpMyAdmin phpMyAdmin

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT an…

6.8Medium

CVE-2026-119561 14 days ago

phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer

phpMyAdmin phpMyAdmin

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST…

3.7Low

CVE-2026-119428 14 days ago

phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled

phpMyAdmin phpMyAdmin

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port …

4.3Medium

CVE-2026-119429 14 days ago

phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set

phpMyAdmin phpMyAdmin

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON…

4.2Medium

CVE-2026-119427 14 days ago

phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting

phpMyAdmin phpMyAdmin

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value…