CVE-2014-4954
published 2014-07-20CVE-2014-4954: Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows…
PriorityP413low3.5CVSS 2.0
AVNACMAuSCNIPAN
EPSS
1.45%
70.6th percentile
Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a database structure page.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | phpmyadmin | < phpmyadmin 4:4.2.6-1 (bookworm) | phpmyadmin 4:4.2.6-1 (bookworm) |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | >= 0 < 4:4.2.6-1 | 4:4.2.6-1 |
| phpmyadmin | phpmyadmin | >= 0 < 4:4.2.6-1 | 4:4.2.6-1 |
| phpmyadmin | phpmyadmin | >= 0 < 4:4.2.6-1 | 4:4.2.6-1 |
| phpmyadmin | phpmyadmin | >= 0 < 4:4.2.6-1 | 4:4.2.6-1 |
CVSS provenance
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
osv3.5LOW
vendor_debian3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2014-4954: phpmyadmin - Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks functi...
vendor_debian·2014·CVSS 3.5
CVE-2014-4954 [LOW] CVE-2014-4954: phpmyadmin - Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks functi...
Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a database structure page.
Scope: local
bookworm: resolved (fixed in 4:4.2.6-1)
bullseye: resolved (fixed in 4:4.2.6-1)
forky: resolved (fixed in 4:4.2.6-1)
sid: resolved (fixed in 4:4.2.6-1)
trixie: resolved (fixed in 4:4.2.6-1)
GHSA
GHSA-6c72-xp63-q5vp: Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure
ghsa_unreviewed·2022-05-17
CVE-2014-4954 [LOW] CWE-79 GHSA-6c72-xp63-q5vp: Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure
Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a database structure page.
OSV
CVE-2014-4954: Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure
osv·2014-07-20·CVSS 3.5
CVE-2014-4954 [LOW] CVE-2014-4954: Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure
Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a database structure page.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.phphttp://www.securityfocus.com/bid/68798https://github.com/phpmyadmin/phpmyadmin/commit/57475371a5b515c83bfc1bb2efcdf3ddb14787edhttp://www.phpmyadmin.net/home_page/security/PMASA-2014-4.phphttp://www.securityfocus.com/bid/68798https://github.com/phpmyadmin/phpmyadmin/commit/57475371a5b515c83bfc1bb2efcdf3ddb14787ed
2014-07-20
Published