PT-2026-21321 · Unknown · Phpmoadmin

Ozer Goker · Publicado 2026-02-20 · Atualizado 2026-02-20 · CVE-2019-25453

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpMoAdmin version 1.1.5

Description The software contains a reflected cross-site scripting issue that allows attackers to inject malicious scripts. Unauthenticated attackers can manipulate the newdb parameter in the moadmin.php file to inject JavaScript payloads. Attackers can create URLs with these payloads, causing arbitrary code execution in users' browsers when they visit the malicious link. The vulnerable parameter is newdb within the ''/moadmin.php'' endpoint.

Recommendations Update phpMoAdmin to a newer version that addresses this issue. As a temporary workaround, sanitize the newdb parameter in the ''moadmin.php'' file to prevent the injection of malicious scripts.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-25453

Produtos afetados

Phpmoadmin

Referências · 5

• 🔥 https://exploit-db.com/exploits/46082 · Exploit
• https://vulncheck.com/advisories/phpmoadmin-reflected-cross-site-scripting-via-moadminphp · Nota
• http://phpmoadmin.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25453 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-25453 · Aviso do Fabricante