CVE-2020-26934

phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.

Score

CVSS 3.1 6.1 Medium

Status

Modified - cve@mitre.org

Published

2020-10-10

Last modified

2024-08-04

Weaknesses

CWE-79

Affected products

• Debian Linux (Debian)
• Fedora (Fedoraproject)
• Backports Sle (Opensuse)
• Leap (Opensuse)
• Phpmyadmin (Phpmyadmin)

References

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html
• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html
• https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6ME…
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2O…
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQF…
• https://security.gentoo.org/glsa/202101-35
• https://www.phpmyadmin.net/security/PMASA-2020-5/