CVE-2020-26934

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00024.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5/
https://security.gentoo.org/glsa/202101-35Third Party Advisory
https://www.phpmyadmin.net/security/PMASA-2020-5/Patch, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00024.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5/
https://security.gentoo.org/glsa/202101-35Third Party Advisory
https://www.phpmyadmin.net/security/PMASA-2020-5/Patch, Vendor Advisory

Timeline

Published: Oct 10, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-269359.8An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in CVE-2020-269368.8Cloudera Data Engineering (CDE) before 1.1 was vulnerable to a CSRF attack.CVE-2020-269387.2In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the authorization and token CVE-2020-269395.3In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent CVE-2020-26943.1Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are CVE-2020-269415.5A local (authenticated) low-privileged user can exploit a behavior in an ESET installer to achieve arbitrary file overwrite (deletion) of an CVE-2020-269429.1An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1 allows unauthenticated attackers to submit a CVE-2020-269439.9An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horiz CVE-2020-269449.8An issue was discovered in Aptean Product Configurator 4.61.0000 on Windows. A Time based SQL injection affects the nameTxt parameter on the CVE-2020-269458.1MyBatis before 3.5.6 mishandles deserialization of object streams.CVE-2020-269477.8monero-wallet-gui in Monero GUI before 0.17.1.0 includes the . directory in an embedded RPATH (with a preference ahead of /usr/lib), which a CVE-2020-269489.8Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.