Medium severity5.4NVD Advisory· Published Feb 13, 2023· Updated Jun 17, 2026
CVE-2023-25727
CVE-2023-25727
Description
In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
phpmyadmin/phpmyadminPackagist | >= 4.3.0, < 4.9.11 | 4.9.11 |
phpmyadmin/phpmyadminPackagist | >= 5.0, < 5.2.1 | 5.2.1 |
Affected products
10cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*range: <4.9.11
- (no CPE)
- osv-coords8 versionspkg:bitnami/phpmyadminpkg:composer/phpmyadmin/phpmyadminpkg:rpm/opensuse/phpMyAdmin&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/phpMyAdmin&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/phpMyAdmin&distro=openSUSE%20Tumbleweedpkg:rpm/suse/phpMyAdmin&distro=SUSE%20Package%20Hub%2012pkg:rpm/suse/phpMyAdmin&distro=SUSE%20Package%20Hub%2015%20SP3pkg:rpm/suse/phpMyAdmin&distro=SUSE%20Package%20Hub%2015%20SP4
< 4.9.11+ 7 more
- (no CPE)range: < 4.9.11
- (no CPE)range: >= 4.3.0, < 4.9.11
- (no CPE)range: < 4.9.11-bp153.2.6.1
- (no CPE)range: < 5.2.1-bp154.2.3.1
- (no CPE)range: < 5.2.1-2.1
- (no CPE)range: < 4.9.11-bp153.2.6.1
- (no CPE)range: < 4.9.11-bp153.2.6.1
- (no CPE)range: < 5.2.1-bp154.2.3.1
Patches
Vulnerability mechanics
References
7- www.phpmyadmin.net/security/PMASA-2023-1/nvdPatchVendor Advisory
- github.com/advisories/GHSA-6hr3-44gx-g6whghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-25727ghsaADVISORY
- github.com/phpmyadmin/phpmyadmin/commit/53f70fd7f3b388639922e6cc1ca51fbe890c91ccghsaWEB
- github.com/phpmyadmin/phpmyadmin/commit/efa2406695551667f726497750d3db91fb6f662eghsaWEB
- www.phpmyadmin.net/security/PMASA-2023-1ghsaWEB
- lists.debian.org/debian-lts-announce/2025/04/msg00016.htmlnvd
News mentions
0No linked articles in our index yet.