Cross-site Scripting in phpmyadmin

中危 6.1CVE-2022-23808 · BIT-phpmyadmin-2022-23808 · GHSA-vcwc-6mr9-8m7c · Published 22/01/2022 · updated 17/06/2026

要点

CVE-2022-23808 是影响 phpmyadmin/phpmyadmin, phpmyadmin (phpmyadmin) 的中危 (CVSS 6.1)漏洞。
未来 30 天内被利用的概率（EPSS）：7.9%，高于 94.7% 的漏洞。
修复：升级到 5.1.2 或更高版本。

Package	Affected versions	Patched versions
phpmyadmin/phpmyadmin Packagist	`≥ 5.1.0, < 5.1.2`	`5.1.2`
phpmyadmin phpmyadmin	`≥ 5.1.0, < 5.1.2`	`5.1.2`

Description

An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.

NVD description

An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.

References

nvd.nist.gov/vuln/detail/CVE-2022-23808 · ADVISORY
phpmyadmin/phpmyadmin commit 44eb12f · WEB
phpmyadmin/phpmyadmin commit 5118acc · WEB
phpmyadmin/phpmyadmin · PACKAGE
infosecwriteups.com/exploit-cve-2022-23808-85041c6e5b97 · WEB
security.gentoo.org/glsa/202311-17 · WEB
phpmyadmin.net/security/PMASA-2022-2 · WEB
phpmyadmin.net/security/PMASA-2022-2 · Patch

phpmyadmin/phpmyadmin 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

phpmyadmin/phpmyadmin

Packagist

≥ 5.1.0, < 5.1.2

5.1.2

phpmyadmin

≥ 5.1.0, < 5.1.2

5.1.2

Description

An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.

NVD description

An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.

phpmyadmin/phpmyadmin 的其他漏洞

查看全部 →