CVE-2014-5274
phpMyAdmin 4.1.x-4.1.14.2 and 4.2.x-4.2.7.0 - Authenticated Stored Cross-Site Scripting via View Name
Title source: llmDescription
Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted view name, related to js/functions.js.
References (4)
Core 4
Core References
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html
Vendor Advisory x_refsource_confirm
http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php
Exploit, Patch x_refsource_confirm
https://github.com/phpmyadmin/phpmyadmin/commit/0cd293f5e13aa245e4a57b8d373597cc0e421b6f
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/60397
Scores
EPSS
0.0022
EPSS Percentile
44.4%
Details
CWE
CWE-79
Status
published
Products (28)
opensuse/opensuse
13.1
opensuse/opensuse
13.2
phpmyadmin/phpmyadmin
4.1.0
phpmyadmin/phpmyadmin
4.1.1
phpmyadmin/phpmyadmin
4.1.2
phpmyadmin/phpmyadmin
4.1.3
phpmyadmin/phpmyadmin
4.1.4
phpmyadmin/phpmyadmin
4.1.5
phpmyadmin/phpmyadmin
4.1.6
phpmyadmin/phpmyadmin
4.1.7
... and 18 more
Published
Aug 22, 2014
Tracked Since
Feb 18, 2026