Servers and applications
CVE-2007-4306
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.10.3 allow remote attackers to inject arbitrary web script or HTML via the (1) unlim_num_rows, (2) sql_query, or (3) pos parameter to (a) tbl_export.php; the (4) session_max_rows or (5) pos parameter to (b) sql.php; the (6) username parameter to (c) server_privileges.php; or the (7) sql_query parameter to (d) main.php. NOTE:…
- Severity
- Medium 4.3
- Published
- 13 Aug 2007
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 1.1% in the next 30 daysHigher than 64% of CVEs. EPSS by FIRST, 12 Nov 2026
- Attack
- Over the network · No login needed
- Attacker can
- Change some data
- CVSS vector
AV:N/AC:M/Au:N/C:N/I:P/A:N- Sources
- NVD
Description
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.10.3 allow remote attackers to inject arbitrary web script or HTML via the (1) unlim_num_rows, (2) sql_query, or (3) pos parameter to (a) tbl_export.php; the (4) session_max_rows or (5) pos parameter to (b) sql.php; the (6) username parameter to (c) server_privileges.php; or the (7) sql_query parameter to (d) main.php. NOTE: vector 5 might be a regression or incomplete fix for CVE-2006-6942.7.
Affected software
| Software | Affected versions |
|---|---|
phpMyAdminServers and applications · cpe:a:phpmyadmin:phpmyadmin |
|