CVE-2019-12616: phpmyadmin Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2019-12616 is a medium (CVSS 6.5) Cross-Site Request Forgery (CSRF) vulnerability in phpmyadmin. EPSS estimates a 20.22% chance of exploitation in the next 30 days, higher than 97.4% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 7 · Related 5Timeline
- 05-06-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS trend
Probability
20.22%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
+1.04 pp
From 19.18% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundphpMyAdmin 4.8 - Cross-Site Request Forgery
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian1 product
- phpmyadmin< 4:4.9.1+dfsg1-2
Phpmyadmin1 product
- phpmyadmin< 4.9.0
Ubuntu1 product
- phpmyadmin< 4:4.0.10-1ubuntu0.1+esm1 | < 4:4.5.4.1-2ubuntu2.1+esm3 | < 4:4.6.6-5ubuntu0.5
3 vendors · 3 products
