Cross-site Scripting in phpmyadmin

MEDIUM 6.1CVE-2022-23808 · BIT-phpmyadmin-2022-23808 · GHSA-vcwc-6mr9-8m7c · Published 22/01/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
phpmyadmin/phpmyadmin Packagist	`≥ 5.1.0, < 5.1.2`	`5.1.2`
phpmyadmin phpmyadmin	`≥ 5.1.0, < 5.1.2`	`5.1.2`

Description

An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.

NVD description

An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.

References

nvd.nist.gov/vuln/detail/CVE-2022-23808 · ADVISORY
phpmyadmin/phpmyadmin commit 44eb12f · WEB
phpmyadmin/phpmyadmin commit 5118acc · WEB
phpmyadmin/phpmyadmin · PACKAGE
infosecwriteups.com/exploit-cve-2022-23808-85041c6e5b97 · WEB
security.gentoo.org/glsa/202311-17 · WEB
phpmyadmin.net/security/PMASA-2022-2 · WEB
phpmyadmin.net/security/PMASA-2022-2 · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free