phpMyAdmin 2.2.0rc3 and earlier allows remote attackers to execute arbitrary commands by inserting them into (1) the strCopyTableOK argument in tblcopy.php, or (2) the strRenameTableOK argument in tblrename.php.
Directory traversal vulnerability in export.php in phpMyAdmin 2.5.5 and earlier allows remote attackers to read arbitrary files via .. (dot dot) sequences in the what parameter.
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTPHOST variable and (2) various scripts in the libraries directory that handle header generation.
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the Username to libraries/auth/cookie.auth.lib.php or (2) the error parameter to error.php.
Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin before 2.6.2-rc1 allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter.
phpMyAdmin 2.6.2-dev, and possibly earlier versions, allows remote attackers to determine the full path of the web root via a direct request to selectlang.lib.php, which reveals the path in a PHP error message.
Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the table parameter.
Description of problem: phpMyAdmin < 2.11.9.1 contains a not yet clearly documented security bug: "Welcome to this security update for phpMyAdmin 2.11.9. Details will follow on http://phpmyadmin.net. Marc Delisle, for the team"
Additional info (http://www.phpmyadmin.net/homepage/downloads.php?relnotes=0): Fixes for 2.11.9.x:
- bug #2031221 [auth] Links to version number on login screen - bug #2032707 [core] PMA does not start if iniset() is disabled - bug #2004915 [bookmarks] Saved queries greater than 1000 chars not displayed - bug #2037381 [export] Export type "replace" does not work - bug #2037375 [export] DROP PROCEDURE needs IF EXISTS - bug #2045512 [export] Numbers in Excel export + [lang] Norwegian UTF-8 original file remerged - bug #2074250 [parser] Undefined variable seenfrom - (2.11.9.1) [security] Code execution vulnerability