CVE-2011-4107

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Nov 17, 2011
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2011

CVE-2011-41084.3The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes itCVE-2011-41099.3Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspeCVE-2011-41102.1The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allows local users to cause a denial of service (NULL pointCVE-2011-41116.8Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 alloCVE-2011-41125.5The net subsystem in the Linux kernel before 3.1 does not properly restrict use of the IFF_TX_SKB_SHARING flag, which allows local users to CVE-2011-41137.5SQL injection vulnerability in the Views module before 6.x-2.13 for Drupal allows remote attackers to execute arbitrary SQL commands via vecCVE-2011-41143.3The par_mktmpdir function in the PAR::Packer module before 1.012 for Perl creates temporary files in a directory with a predictable name witCVE-2011-41157.5Parallel::ForkManager module before 1.0.0 for Perl does not properly handle temporary files.CVE-2011-41163.3_is_safe in the File::Temp module for Perl does not properly handle symlinks.CVE-2011-41177.5The Batch::BatchRun module 1.03 for Perl does not properly handle temporary files.CVE-2011-41186.0Mahara before 1.4.1, when MNet (aka the Moodle network feature) is used, allows remote authenticated users to gain privileges via a jump to CVE-2011-41199.8caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.
CVE-2011-4107: Medium severity, CVSS 6.5 | Vulnix