CVE-2018-19970

MEDIUM

phpMyAdmin <4.8.4 - XSS

Title source: llm

Description

In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name.

References (4)

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/106181

[Mailing List, Third Party Advisory] https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html

[Third Party Advisory] https://security.gentoo.org/glsa/201904-16

[Patch, Vendor Advisory] https://www.phpmyadmin.net/security/PMASA-2018-8/

Scores

CVSS v3 6.1

EPSS 0.0150

EPSS Percentile 80.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-79

Status published

Affected Products (3)

phpmyadmin/phpmyadmin < 4.8.4

debian/debian_linux

phpmyadmin/phpmyadmin < 4.8.4Packagist

Timeline

Published Dec 11, 2018

Tracked Since Feb 18, 2026