CVE-2007-1395

Published: Mar 10, 2007Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by injecting arbitrary JavaScript or HTML in a (1) db or (2) table parameter value followed by an uppercase </SCRIPT> end tag, which bypasses the protection against lowercase </script>.

Affected (22)

Products: Phpmyadmin: Phpmyadmin

Phpmyadmin

1 product

Phpmyadmin

Configuration A

22 vulnerable

Vulnerable Software	Affected Versions
Phpmyadmin Phpmyadmin	Version 2.8.0.1
Phpmyadmin Phpmyadmin	Version 2.8.0.2
Phpmyadmin Phpmyadmin	Version 2.8.0.3
Phpmyadmin Phpmyadmin	Version 2.8.0
Phpmyadmin Phpmyadmin	Version 2.8.1
Phpmyadmin Phpmyadmin	Version 2.8.1_dev
Phpmyadmin Phpmyadmin	Version 2.8.2
Phpmyadmin Phpmyadmin	Version 2.8.3
Phpmyadmin Phpmyadmin	Version 2.8.4
Phpmyadmin Phpmyadmin	Version 2.9.0.1
Phpmyadmin Phpmyadmin	Version 2.9.0.2
Phpmyadmin Phpmyadmin	Version 2.9.0.3
Phpmyadmin Phpmyadmin	Version 2.9.0
Phpmyadmin Phpmyadmin	Version 2.9.0_beta1
Phpmyadmin Phpmyadmin	Version 2.9.0_dev
Phpmyadmin Phpmyadmin	Version 2.9.0_rc1
Phpmyadmin Phpmyadmin	Version 2.9.1.1
Phpmyadmin Phpmyadmin	Version 2.9.1
Phpmyadmin Phpmyadmin	Version 2.9.1_rc1
Phpmyadmin Phpmyadmin	Version 2.9.1_rc2
Phpmyadmin Phpmyadmin	Version 2.9.2
Phpmyadmin Phpmyadmin	Version 2.9