Show filters
9 Total Results
Displaying 1-9 of 9
Sort by:
Attacker Value
Unknown
CVE-2023-40619
Disclosure Date: September 20, 2023 (last updated October 08, 2023)
phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the 'ma[]' POST parameter is deserialized.
0
Attacker Value
Unknown
CVE-2019-10784
Disclosure Date: February 04, 2020 (last updated February 21, 2025)
phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, "database.php" does not verify the source of an HTTP request. This can be leveraged by a remote attacker to trick a logged-in administrator to visit a malicious page with a CSRF exploit and execute arbitrary system commands on the server.
0
Attacker Value
Unknown
CVE-2012-1600
Disclosure Date: May 14, 2014 (last updated October 05, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in functions.php in phpPgAdmin before 5.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) type of a function.
0
Attacker Value
Unknown
CVE-2011-3598
Disclosure Date: October 08, 2011 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in phpPgAdmin before 5.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) a web page title, related to classes/Misc.php; or the (2) return_url or (3) return_desc parameter to display.php.
0
Attacker Value
Unknown
CVE-2008-5587
Disclosure Date: December 16, 2008 (last updated October 04, 2023)
Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is enabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the _language parameter to index.php.
0
Attacker Value
Unknown
CVE-2007-5728
Disclosure Date: October 30, 2007 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in phpPgAdmin 3.5 to 4.1.1, and possibly 4.1.2, allows remote attackers to inject arbitrary web script or HTML via certain input available in PHP_SELF in (1) redirect.php, possibly related to (2) login.php, different vectors than CVE-2007-2865.
0
Attacker Value
Unknown
CVE-2007-2865
Disclosure Date: May 25, 2007 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in sqledit.php in phpPgAdmin 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the server parameter.
0
Attacker Value
Unknown
CVE-2005-2256
Disclosure Date: July 13, 2005 (last updated October 04, 2023)
Encoded directory traversal vulnerability in phpPgAdmin 3.1 to 3.5.3 allows remote attackers to access arbitrary files via "%2e%2e%2f" (encoded dot dot) sequences in the formLanguage parameter.
0
Attacker Value
Unknown
CVE-2001-0479
Disclosure Date: June 27, 2001 (last updated February 22, 2025)
Directory traversal vulnerability in phpPgAdmin 2.2.1 and earlier versions allows remote attackers to execute arbitrary code via a .. (dot dot) in an argument to the sql.php script.
0
