phpMyAdmin · product
phpMyAdmin
14 CVEs · 1 exploited
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- exploited in the wild
- 1
- check available
- 1
Every one of the 14 is a mark on the map. Named now: 1 to 14, most at risk first.
- PhpMyAdmin Scripts - Remote Code Execution
- phpMyAdmin < 5.1.2 - Cross-Site Scripting
- PhpMyAdmin exposure of sensitive information
- In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.
- An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-fac…
- An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for X…
- phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set
- An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the Insert tab.
- phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql
- phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled
- phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting
- phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute
- phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer
- phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.