PT-2026-21321 · Unknown · Phpmoadmin

Ozer Goker · Published 2026-02-20 · Updated 2026-02-20 · CVE-2019-25453

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpMoAdmin version 1.1.5

Description The software contains a reflected cross-site scripting issue that allows attackers to inject malicious scripts. Unauthenticated attackers can manipulate the newdb parameter in the moadmin.php file to inject JavaScript payloads. Attackers can create URLs with these payloads, causing arbitrary code execution in users' browsers when they visit the malicious link. The vulnerable parameter is newdb within the ''/moadmin.php'' endpoint.

Recommendations Update phpMoAdmin to a newer version that addresses this issue. As a temporary workaround, sanitize the newdb parameter in the ''moadmin.php'' file to prevent the injection of malicious scripts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25453

Affected Products

Phpmoadmin

References · 5

• 🔥 https://exploit-db.com/exploits/46082 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25453 · Security Note
• https://osv.dev/vulnerability/CVE-2019-25453 · Vendor Advisory
• https://vulncheck.com/advisories/phpmoadmin-reflected-cross-site-scripting-via-moadminphp · Note
• http://phpmoadmin.com · Note