CVE-2011-1940 — Cross-site Scripting in Phpmyadmin

CWE-79 — Cross-site Scripting5 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 47.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PhpmyadminDebian Phpmyadmin
Timeline
PublishedJan 26
Latest updateMay 17

Description

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.3.x before 3.3.10.1 and 3.4.x before 3.4.1 allow remote attackers to inject arbitrary web script or HTML via a crafted table name that triggers improper HTML rendering on a Tracking page, related to (1) libraries/tbl_links.inc.php and (2) tbl_tracking.php.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages4 packages

▶debiandebian/phpmyadmin< phpmyadmin 4:3.4.1-1 (bookworm)
▶Packagistphpmyadmin/phpmyadmin3.3.0 — 3.3.10.1+1
▶Debianphpmyadmin/phpmyadmin< 4:3.4.1-1+3
▶NVDphpmyadmin/phpmyadmin16 versions+15

Patches

Patch: www.phpmyadmin.net ↗Patch: www.phpmyadmin.net ↗

🔴Vulnerability Details

3
GHSA
phpMyAdmin Vulnerable to Cross-Site Scripting↗2022-05-17
▶
OSV
phpMyAdmin Vulnerable to Cross-Site Scripting↗2022-05-17
▶
OSV
CVE-2011-1940: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3↗2012-01-26
▶

📋Vendor Advisories

1
Debian
CVE-2011-1940: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.3.x before 3...↗2011
▶