The remote web server is running a version of phpMyAdmin earlier than 2.11.10.  Such versions are potentially affected by multiple vulnerabilities : 

  - A cross-site request forgery attack because the application uses the 'unserialize()' PHP function on potentially unsafe data in the setup script.(CVE-2009-4605)

  - An insecure file creation and deletion vulnerability due to the way phpMyAdmin creates temporary files.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 uses predictable filenames for temporary
    files, which has unknown impact and attack vectors. (CVE-2008-7252)

The remote host is affected by the vulnerability described in GLSA-201201-01 (phpMyAdmin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in phpMyAdmin. Please       review the CVE identifiers and phpMyAdmin Security Advisories referenced       below for details.
  Impact :

    Remote attackers might be able to insert and execute PHP code, include       and execute local PHP files, or perform Cross-Site Scripting (XSS)       attacks via various vectors.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-7251     phpMyAdmin may create a temporary directory, if the     configured directory does not exist yet, with insecure     filesystem permissions.

  - CVE-2008-7252     phpMyAdmin uses predictable filenames for temporary     files, which may lead to a local denial of service     attack or privilege escalation.

  - CVE-2009-4605     The setup.php script shipped with phpMyAdmin may     unserialize untrusted data, allowing for cross site     request forgery.

The use of unserialize() on POST data which could have lead to remote code execution (CVE-2009-4605) has been fixed as well as some minor temporary file issues (CVE-2008-7251, CVE-2008-7252).

ID	Name	Product	Family	Published	Updated	Severity
5304	phpMyAdmin < 2.11.10 Multiple Vulnerabilities	Nessus Network Monitor	CGI	1/20/2010	3/6/2019	high
432814	SCA: security update for phpmyadmin/phpmyadmin (GHSA-9645-6g72-2pv8)	Tenable Cloud Security	SCA Checks	8/11/2025	7/2/2026	critical
432814	SCA: security update for phpmyadmin/phpmyadmin (GHSA-9645-6g72-2pv8)	Tenable Self-Hosted Container Security	SCA Checks	8/11/2025	7/2/2026	critical
57433	GLSA-201201-01 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	1/5/2012	1/6/2021	critical
45556	Debian DSA-2034-1 : phpmyadmin - several vulnerabilities	Nessus	Debian Local Security Checks	4/19/2010	1/4/2021	critical
44044	openSUSE Security Update : phpMyAdmin (phpMyAdmin-1801)	Nessus	SuSE Local Security Checks	1/18/2010	1/14/2021	critical

Detections

Analytics

Plugins Search

high

critical

critical

critical

critical

critical