Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2005-3301 — Cross-site Scripting in Phpmyadmin

6 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
11.8%
top 6.26%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
PhpmyadminDebian Phpmyadmin
Timeline
PublishedOct 24
Latest updateMay 1

Description

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-pl3 allow remote attackers to inject arbitrary web script or HTML via certain arguments to (1) left.php, (2) queryframe.php, or (3) server_databases.php.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/phpmyadmin< phpmyadmin 4:2.6.4-pl3-1 (bookworm)
▶Debianphpmyadmin/phpmyadmin< 4:2.6.4-pl3-1+3
▶NVDphpmyadmin/phpmyadmin4 versions+3

Patches

Patch: www.phpmyadmin.net ↗Patch: www.phpmyadmin.net ↗

🔴Vulnerability Details

2
GHSA
GHSA-2cm4-w9vc-vwpc: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2↗2022-05-01
▶
OSV
CVE-2005-3301: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2↗2005-10-24
▶

💥Exploits & PoCs

2
Exploit-DB
phpMyAdmin 2.x - 'queryframe.php' Cross-Site Scripting↗2005-05-20
▶
Exploit-DB
phpMyAdmin 2.x - 'server_databases.php' Cross-Site Scripting↗2005-05-20
▶

📋Vendor Advisories

1
Debian
CVE-2005-3301: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-p...↗2005
▶