Servers and applications
CVE-2011-0986 phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent file.
Severity Medium 5.0
Published 14 Feb 2011
Last changed 16 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 1.6% in the next 30 daysHigher than 75% of CVEs. EPSS by FIRST , 12 Nov 2026
Attack Over the network · No login needed
Attacker can Read some data
CVSS vector AV:N/AC:L/Au:N/C:P/I:N/A:N
Sources NVD Affected software Software Affected versions phpMyAdminServers and applications · cpe:a:phpmyadmin:phpmyadmin Version 3.3.9.0 Version 3.3.8.1 Version 3.3.8 Version 3.3.7 All 67 release lines Version 2.11.0 Version 2.11.1.0 Version 2.11.1.1 Version 2.11.1.2 Version 2.11.2.0 Version 2.11.2.1 Version 2.11.2.2 Version 2.11.3.0 Version 2.11.4.0 Version 2.11.5.0 Version 2.11.5.1 Version 2.11.5.2 Version 2.11.6.0 Version 2.11.7.0 Version 2.11.7.1 Version 2.11.8.0 Version 2.11.9.0 Version 2.11.9.1 Version 2.11.9.2 Version 2.11.9.3 Version 2.11.9.4 Version 2.11.9.5 Version 2.11.9.6 Version 2.11.10.0 Version 2.11.10.1 Version 2.11.11 Version 2.11.11.1 Version 3.0.0-alpha Version 3.0.0-beta Version 3.0.0-rc1 Version 3.0.0 Version 3.0.1-rc1 Version 3.0.1 Version 3.0.1.1 Version 3.1.0-beta1 Version 3.1.0 Version 3.1.1-rc1 Version 3.1.1 Version 3.1.2-rc1 Version 3.1.2 Version 3.1.3-rc1 Version 3.1.3 Version 3.1.3.1 Version 3.1.3.2 Version 3.1.4-rc2 Version 3.1.4 Version 3.1.5-rc1 Version 3.1.5 Version 3.2.0-beta1 Version 3.2.0-rc1 Version 3.2.0 Version 3.2.1-rc1 Version 3.2.1 Version 3.2.2-rc1 Version 3.2.2 Version 3.3.0.0 Version 3.3.1.0 Version 3.3.2.0 Version 3.3.3.0 Version 3.3.4.0 Version 3.3.5.0 Version 3.3.5.1 Version 3.3.6 Version 3.3.7 Version 3.3.8 Version 3.3.8.1 Version 3.3.9.0
References NVD https://nvd.nist.gov/vuln/detail/CVE-2011-0986 CVE.org https://www.cve.org/CVERecord?id=CVE-2011-0986