{"schemaVersion":3,"id":"USN-4639-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"phpmyadmin vulnerabilities\n\nIt was discovered that there was a bug in the way phpMyAdmin handles the\nphpMyAdmin Configuration Storage tables. An authenticated attacker could\nuse this vulnerability to cause phpmyAdmin to leak sensitive files.\n(CVE-2018-19968)\n\nIt was discovered that phpMyAdmin incorrectly handled user input. An\nattacker could possibly use this for an XSS attack. (CVE-2018-19970)\n\nIt was discovered that phpMyAdmin mishandled certain input. An attacker\ncould use this vulnerability to execute a cross-site scripting (XSS) attack\nvia a crafted URL. (CVE-2018-7260)\n\nIt was discovered that phpMyAdmin failed to sanitize certain input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted database name. (CVE-2019-11768)\n\nIt was discovered that phpmyadmin incorrectly handled some requests. An\nattacker could possibly use this to perform a CSRF attack. (CVE-2019-12616)\n\nIt was discovered that phpMyAdmin failed to sanitize certain input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted username. (CVE-2019-6798, CVE-2020-10804,\nCVE-2020-5504)\n\nIt was discovered that phpMyAdmin would allow sensitive files to be leaked\nif certain configuration options were set. An attacker could use this\nvulnerability to access confidential information. (CVE-2019-6799)\n\nIt was discovered that phpMyAdmin failed to sanitize certain input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted database or table name. (CVE-2020-10802)\n\nIt was discovered that phpMyAdmin did not properly handle data from the\ndatabase when displaying it. If an attacker were to insert specially-\ncrafted data into certain database tables, the attacker could execute a\ncross-site scripting (XSS) attack. (CVE-2020-10803)\n\nIt was discovered that phpMyAdmin was vulnerable to an XSS attack. If a\nvictim were to click on a crafted link, an attacker could run malicious\nJavaScript on the victim's system. (CVE-2020-26934)\n\nIt was discovered that phpMyAdmin did not properly handler certain SQL\nstatements in the search feature. An attacker could use this vulnerability\nto inject malicious SQL into a query. (CVE-2020-26935)\n\nIt was discovered that phpMyAdmin did not properly sanitize certain input.\nAn attacker could use this vulnerability to possibly execute an HTML injection\nor a cross-site scripting (XSS) attack. (CVE-2019-19617)","dates":{"published":"2020-11-19T15:01:30.000Z","modified":"2026-04-27T19:02:48.915Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"phpmyadmin","name":"phpmyadmin","label":"phpmyadmin","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/phpmyadmin","purlType":"deb","versions":[{"text":"< 4:4.6.6-5ubuntu0.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4:4.6.6-5ubuntu0.5","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-4639-1","label":"ubuntu.com/security/notices/USN-4639-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-7260","label":"ubuntu.com/security/CVE-2018-7260","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-19968","label":"ubuntu.com/security/CVE-2018-19968","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-19970","label":"ubuntu.com/security/CVE-2018-19970","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2019-6798","label":"ubuntu.com/security/CVE-2019-6798","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2019-6799","label":"ubuntu.com/security/CVE-2019-6799","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2019-11768","label":"ubuntu.com/security/CVE-2019-11768","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2019-12616","label":"ubuntu.com/security/CVE-2019-12616","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2019-19617","label":"ubuntu.com/security/CVE-2019-19617","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2020-5504","label":"ubuntu.com/security/CVE-2020-5504","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2020-10802","label":"ubuntu.com/security/CVE-2020-10802","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2020-10803","label":"ubuntu.com/security/CVE-2020-10803","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2020-10804","label":"ubuntu.com/security/CVE-2020-10804","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2020-26934","label":"ubuntu.com/security/CVE-2020-26934","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2020-26935","label":"ubuntu.com/security/CVE-2020-26935","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2018-19968","CVE-2018-19970","CVE-2018-7260","CVE-2019-11768","CVE-2019-12616","CVE-2019-19617","CVE-2019-6798","CVE-2019-6799","CVE-2020-10802","CVE-2020-10803","CVE-2020-10804","CVE-2020-26934","CVE-2020-26935","CVE-2020-5504"],"downstream":[],"duplicates":[],"related":["CVE-2018-19968","CVE-2018-19970","CVE-2018-7260","CVE-2019-11768","CVE-2019-12616","CVE-2019-19617","CVE-2019-6798","CVE-2019-6799","CVE-2020-10802","CVE-2020-10803","CVE-2020-10804","CVE-2020-26934","CVE-2020-26935","CVE-2020-5504"]},"timeline":[{"kind":"published","date":"2020-11-19T15:01:30.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-27T19:02:48.915Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T19:34:46.998Z","stale":false,"partial":false}}