CVE-2023-25727

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Feb 13, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-257286.5The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted URI when interactionCVE-2023-257298.8Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensions being able to opeCVE-2023-25738.8Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input fieldCVE-2023-257305.4A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode iCVE-2023-257318.8Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwriteCVE-2023-257328.8When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not correctly calculated pCVE-2023-257337.5The return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null pointer dereference.CVE-2023-257348.1After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote path that would lead to CVE-2023-257358.8Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment CVE-2023-257369.8An invalid downcast from `nsHTMLDocument` to `nsIContent` could have lead to undefined behavior. This vulnerability affects Firefox < 110.CVE-2023-257378.8An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This vulnerability affectCVE-2023-257386.5Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid valu