CVE-2008-4775: Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when register_globals is…

PriorityP420low2.6CVSS 2.0

AVNACHAuNCNIPAN

EXPLOIT

EPSS

6.06%

92.5th percentile

Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the db parameter, a different vector than CVE-2006-6942 and CVE-2007-5977.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	phpmyadmin	< phpmyadmin 4:2.11.8.1-4 (bookworm)	phpmyadmin 4:2.11.8.1-4 (bookworm)
phpmyadmin	phpmyadmin	—	—
phpmyadmin	phpmyadmin	—	—
phpmyadmin	phpmyadmin	—	—
phpmyadmin	phpmyadmin	>= 0 < 4:2.11.8.1-4	4:2.11.8.1-4
phpmyadmin	phpmyadmin	>= 0 < 4:2.11.8.1-4	4:2.11.8.1-4
phpmyadmin	phpmyadmin	>= 0 < 4:2.11.8.1-4	4:2.11.8.1-4
phpmyadmin	phpmyadmin	>= 0 < 4:2.11.8.1-4	4:2.11.8.1-4

CVSS provenance

nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:P/A:N

osv6.8MEDIUM

vendor_debian6.8LOW

vendor_redhat6.8MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.