PT-2026-21322 · Unknown · Phpmoadmin

Ozer Goker · Publicado 2026-02-20 · Atualizado 2026-02-20 · CVE-2019-25454

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpMoAdmin version 1.1.5

Description The software contains a stored cross-site scripting issue that allows attackers without authentication to inject malicious scripts. This is achieved by manipulating the collection parameter. Attackers can send GET requests to the ''moadmin.php'' endpoint with script payloads in the collection parameter during collection creation. This allows for the execution of arbitrary JavaScript in the browsers of users.

Recommendations Update phpMoAdmin to a newer version that addresses this issue. As a temporary workaround, sanitize the collection parameter to prevent script injection. Restrict access to the ''moadmin.php'' endpoint to authorized users only.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-25454

Produtos afetados

Phpmoadmin

Referências · 5

• 🔥 https://exploit-db.com/exploits/46082 · Exploit
• https://vulncheck.com/advisories/phpmoadmin-stored-cross-site-scripting-via-collection-parameter · Nota
• https://osv.dev/vulnerability/CVE-2019-25454 · Aviso do Fabricante
• http://phpmoadmin.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25454 · Nota de Segurança