{"id":"CVE-2018-7260","published":"2018-02-21T15:00:00Z","modified":"2024-08-05T06:24:11Z","title":"Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote…","vendor":null,"product":null,"tier":"tail","description":{"text":"Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01602,"percentile":0.75725,"provenance":"source"},"cwes":[],"references":[{"url":"https://udiniya.wordpress.com/2018/02/21/a-tale-of-stealing-session-cookie-in-phpmyadmin/","tags":["x_refsource_MISC"]},{"url":"http://www.securityfocus.com/bid/103099","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2018-1/","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/d2886a3","tags":["x_refsource_CONFIRM"]}],"priority":{"score":15.1,"factors":[{"name":"EPSS percentile","points":15.14}]},"affected":[{"ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","vulnerableRanges":["<4.7.8"],"patched":["4.7.8"],"from":["GHSA-gqmj-f46x-wqhw"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3994","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2017-1000018","published":"2017-07-13","fixed":"4.6.6","kev":false},{"cve":"CVE-2017-18264","published":"2018-05-01","fixed":"4.7.0","kev":false},{"cve":"CVE-2017-1000499","published":"2018-01-03","fixed":"4.7.7","kev":false,"link":{"from":"CVE-2017-1000499","to":"CVE-2018-7260","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:phpmyadmin/phpmyadmin","fromFixed":"4.7.7","toFixed":"4.7.8","daysApart":49}]}},{"cve":"CVE-2018-7260","published":"2018-02-21","fixed":"4.7.8","kev":false},{"cve":"CVE-2018-10188","published":"2018-04-19","fixed":"4.8.0.1","kev":false},{"cve":"CVE-2018-12581","published":"2018-06-21","fixed":"4.8.2","kev":false},{"cve":"CVE-2018-12613","published":"2018-06-21","fixed":"4.8.2","kev":false}],"package":"Packagist:phpmyadmin/phpmyadmin"}}