CVE-2020-26934
Fixed in a distro release EPSS 2%
phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.
Products: phpmyadmin, opensuse backports_sle, opensuse leap, fedoraproject fedora, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | phpmyadmin/phpmyadmin | 4.9.6 |
| Packagist | phpmyadmin/phpmyadmin | 5.0.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | phpmyadmin | 4:4.9.7+dfsg1-1 |
| Debian 13 | phpmyadmin | 4:4.9.7+dfsg1-1 |
| Debian 14 | phpmyadmin | 4:4.9.7+dfsg1-1 |
| Debian 9 | phpmyadmin | 4:4.6.6-4+deb9u2 |
| SUSE Package Hub 12 | phpMyAdmin | 4.9.7-bp151.3.24.1 |
| SUSE Package Hub 12 | phpMyAdmin | 4.9.6-bp152.2.3.1 |
| SUSE Package Hub 15 | phpMyAdmin | 4.9.7-bp151.3.24.1 |
| SUSE Package Hub 15 SP1 | phpMyAdmin | 4.9.6-bp152.2.3.1 |
| SUSE Package Hub 15 SP1 | phpMyAdmin | 4.9.7-bp151.3.24.1 |
| SUSE Package Hub 15 SP2 | phpMyAdmin | 4.9.6-bp152.2.3.1 |
| Ubuntu 18.04 LTS | phpmyadmin | 4:4.6.6-5ubuntu0.5 |
| Ubuntu Pro 14.04 LTS | phpmyadmin | no fix |
| Ubuntu Pro 14.04 LTS | phpmyadmin | 4:4.0.10-1ubuntu0.1+esm4 |
| Ubuntu Pro 16.04 LTS | phpmyadmin | no fix |
| Ubuntu Pro 16.04 LTS | phpmyadmin | 4:4.5.4.1-2ubuntu2.1+esm6 |
| Ubuntu Pro 18.04 LTS | phpmyadmin | 4:4.6.6-5ubuntu0.5+esm1 |
| Ubuntu Pro 20.04 LTS | phpmyadmin | 4:4.9.5+dfsg1-2ubuntu0.1~esm1 |
| openSUSE Leap 15.1 | phpMyAdmin | 4.9.7-bp151.3.24.1 |
| openSUSE Leap 15.1 | phpMyAdmin | 4.9.6-bp152.2.3.1 |
| openSUSE Leap 15.2 | phpMyAdmin | 4.9.6-bp152.2.3.1 |
| openSUSE Tumbleweed | phpMyAdmin | 5.1.1-1.2 |