Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2007-5386 — Cross-site Scripting in Phpmyadmin

CWE-79 — Cross-site Scripting6 documents6 sources
Severity
4.3MEDIUMNVD
EPSS
11.4%
top 6.40%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
PhpmyadminDebian Phpmyadmin
Timeline
PublishedOct 12
Latest updateMay 1

Description

Cross-site scripting (XSS) vulnerability in scripts/setup.php in phpMyAdmin 2.11.1, when accessed by a browser that does not URL-encode requests, allows remote attackers to inject arbitrary web script or HTML via the query string.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/phpmyadmin< phpmyadmin 4:2.11.1.2-1 (bookworm)
▶Debianphpmyadmin/phpmyadmin< 4:2.11.1.2-1+3

🔴Vulnerability Details

2
GHSA
GHSA-vcvq-3f23-fr47: Cross-site scripting (XSS) vulnerability in scripts/setup↗2022-05-01
▶
OSV
CVE-2007-5386: Cross-site scripting (XSS) vulnerability in scripts/setup↗2007-10-12
▶

💥Exploits & PoCs

1
Exploit-DB
phpMyAdmin 2.11.1 - 'setup.php' Cross-Site Scripting↗2007-10-09
▶

📋Vendor Advisories

1
Debian
CVE-2007-5386: phpmyadmin - Cross-site scripting (XSS) vulnerability in scripts/setup.php in phpMyAdmin 2.11...↗2007
▶

💬Community

1
Bugzilla
phpMyAdmin 2.11.1.2 is released (fixes CVE-2007-5386, CVE-2007-5589)↗2007-10-16
▶