6.4Media

CVE-2025-24530

phpMyAdmin phpMyAdmin Publicada: 2025-01-23 03:00 (hace 1 año)

Descripción

An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS.

Debilidad (CWE): CWE-79

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
phpMyAdmin	phpMyAdmin	5.0.0 – < 5.2.2

Referencias y parches

Puntuación CVSS

6.4Media

Fuente: mitre · CVSS 3.1

Vector de ataque: Red
Complejidad: Baja
Privilegios: Bajos
Interacción del usuario: Ninguna
Alcance: Cambiado
Confidencialidad: Bajo
Integridad: Bajo
Disponibilidad: Ninguno

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Todas las puntuaciones (2)

cna	CVSS 3.1	6.4Media
cve@mitre.org	CVSS 3.1	6.4Media

EPSS (probabilidad de explotación en 30 días)

0.41%

superior al 36 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: no
Impacto técnico: partial

Cronología

ID reservado2025-01-23
Publicada2025-01-23 03:00
Llegó a IP-DB2026-10-24 23:58
Última actualización2026-06-17 11:59

Asignada por (CNA): mitre
Estado en NVD: Deferred

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — phpMyAdmin

5.4Media

CVE-2026-119563 hace 12 días

phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name

phpMyAdmin phpMyAdmin

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name contains HTML marku…

4.2Media

CVE-2026-119562 hace 12 días

phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute

phpMyAdmin phpMyAdmin

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT an…

6.8Media

CVE-2026-119561 hace 12 días

phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer

phpMyAdmin phpMyAdmin

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST…

3.7Baja

CVE-2026-119428 hace 12 días

phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled

phpMyAdmin phpMyAdmin

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port …

4.3Media

CVE-2026-119429 hace 12 días

phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set

phpMyAdmin phpMyAdmin

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON…

4.2Media

CVE-2026-119427 hace 12 días

phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting

phpMyAdmin phpMyAdmin

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value…