CVE-2011-4634

phpMyAdmin 3.4.0-3.4.7 - Stored Cross-Site Scripting via Database Name or SQL Query

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.8 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted database name, related to the Database Synchronize panel; (2) a crafted database name, related to the Database rename panel; (3) a crafted SQL query, related to the table overview panel; (4) a crafted SQL query, related to the view creation dialog; (5) a crafted column type, related to the table search dialog; or (6) a crafted column type, related to the create index dialog.

References (7)

Core 7
Core References
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071040.html
Patch, Vendor Advisory x_refsource_confirm
http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2011:198

Scores

EPSS 0.0042
EPSS Percentile 62.2%

Details

CWE
CWE-79
Status published
Products (11)
phpmyadmin/phpmyadmin 3.4.0.0
phpmyadmin/phpmyadmin 3.4.1.0
phpmyadmin/phpmyadmin 3.4.2.0
phpmyadmin/phpmyadmin 3.4.3.0
phpmyadmin/phpmyadmin 3.4.3.1
phpmyadmin/phpmyadmin 3.4.3.2
phpmyadmin/phpmyadmin 3.4.4.0
phpmyadmin/phpmyadmin 3.4.5.0
phpmyadmin/phpmyadmin 3.4.6.0
phpmyadmin/phpmyadmin 3.4.7.0
... and 1 more
Published Dec 22, 2011
Tracked Since Feb 18, 2026