-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe GitHub patch explicitly modifies PMA_unInlineEditRow in js/sql.js by replacing .html(new_html) with .text(new_html). The .html() method renders raw HTML, making it vulnerable to XSS when handling untrusted input like database/table/column names. The CVE description directly attributes the vulnerability to improper handling in this function, and the commit diff confirms the insecure code pattern was present here.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpmyadmin/phpmyadmin | composer | >= 3.4.0, < 3.4.5 | 3.4.5 |