PT-2026-21322 · Unknown · Phpmoadmin

Ozer Goker · Published 2026-02-20 · Updated 2026-02-20 · CVE-2019-25454

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpMoAdmin version 1.1.5

Description The software contains a stored cross-site scripting issue that allows attackers without authentication to inject malicious scripts. This is achieved by manipulating the collection parameter. Attackers can send GET requests to the ''moadmin.php'' endpoint with script payloads in the collection parameter during collection creation. This allows for the execution of arbitrary JavaScript in the browsers of users.

Recommendations Update phpMoAdmin to a newer version that addresses this issue. As a temporary workaround, sanitize the collection parameter to prevent script injection. Restrict access to the ''moadmin.php'' endpoint to authorized users only.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25454

Affected Products

Phpmoadmin

References · 5

• 🔥 https://exploit-db.com/exploits/46082 · Exploit
• https://osv.dev/vulnerability/CVE-2019-25454 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25454 · Security Note
• https://vulncheck.com/advisories/phpmoadmin-stored-cross-site-scripting-via-collection-parameter · Note
• http://phpmoadmin.com · Note