CVE-2020-26934

MEDIUM6.1EPSS 2.8%

phpMyAdmin Cross-site Scripting (XSS)

Published: 5/24/2022Modified: 5/7/2026

Also known as:GHSA-6349-53vr-7hcrBIT-phpmyadmin-2020-26934DEBIAN-CVE-2020-26934

Description

phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.

Affected packages (3)

Bitnami/phpmyadmin>= 4.9.0, < 4.9.6, >= 5.0.0, < 5.0.3
Debian/phpmyadminfrom 0, < 4:4.9.7+dfsg1-1
Packagist/phpmyadmin/phpmyadmin>= 4.9.0, < 4.9.6

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (19)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-26934
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2020-26934
PATCHhttps://github.com/phpmyadmin/composer
WEBhttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html
WEBhttp://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html
WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/phpmyadmin/phpmyadmin/CVE-2020-26934.yaml
WEBhttps://lists.debian.org/debian-lts-announce/2020/10/msg00024.html
WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K
WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K/
WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO
WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO/
WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5
WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5/
WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K
WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO
WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5
WEBhttps://security.gentoo.org/glsa/202101-35
WEBhttps://www.phpmyadmin.net/security/PMASA-2020-5
WEBhttps://www.phpmyadmin.net/security/PMASA-2020-5/