CVE-2012-4345

Phpmyadmin < 3.4.11.1 - XSS

Title source: rule

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.

References (3)

[Vendor Advisory] http://www.mandriva.com/security/advisories?name=MDVSA-2012:136

[Patch, Vendor Advisory] http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php

[Various Sources] https://hermes.opensuse.org/messages/15513071

Scores

EPSS 0.0021

EPSS Percentile 43.0%

Classification

CWE

CWE-79

Status published

Affected Products (23)

phpmyadmin/phpmyadmin

... and 8 more

Timeline

Published Aug 21, 2012

Tracked Since Feb 18, 2026