CVE-2018-10188

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/103936Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040752Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/44496/Exploit, Third Party Advisory, VDB Entry
https://www.phpmyadmin.net/security/PMASA-2018-2/Vendor Advisory
http://www.securityfocus.com/bid/103936Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040752Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/44496/Exploit, Third Party Advisory, VDB Entry
https://www.phpmyadmin.net/security/PMASA-2018-2/Vendor Advisory

Timeline

Published: Apr 19, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-101897.5An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tr CVE-2018-10197.5A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C CVE-2018-101907.8A vulnerability in London Trust Media Private Internet Access (PIA) VPN Client v77 for Windows could allow an unauthenticated, local attacke CVE-2018-101919.8In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the prese CVE-2018-101929.8IPVanish 3.0.11 for macOS suffers from a root privilege escalation vulnerability. The `com.ipvanish.osx.vpnhelper` LaunchDaemon implements a CVE-2018-101937.5LogMeIn LastPass through 4.15.0 allows remote attackers to cause a denial of service (browser hang) via an HTML document because the resourc CVE-2018-101947.8The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent o CVE-2018-101957.1lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that caus CVE-2018-101965.5NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows r CVE-2018-101979.8There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before 10.18.040 in ELO ELO CVE-2018-101984.3An issue was discovered in OTRS 6.0.x before 6.0.7. An attacker who is logged into OTRS as a customer can use the ticket overview screen to CVE-2018-101999.8In versions of mruby up to and including 1.4.0, a use-after-free vulnerability exists in src/io.c::File#initilialize_copy(). An attacker tha