GHSA-q586-xpwr-jc3jLow

phpMyAdmin cross-site scripting vulnerability in crafted view name

Published
May 14, 2022
Last Modified
August 16, 2023

🔗 CVE IDs covered (1)

CVE-2014-5274 →

📋 Description

A cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted view name, related to js/functions.js.

🎯 Affected products2

  • composer/phpmyadmin/phpmyadmin:>= 4.1.0, < 4.1.14.3
  • composer/phpmyadmin/phpmyadmin:>= 4.2.0, < 4.2.7.1

🔗 References (5)