CVE catalog

CVE-2006-1678

phpmyadmin: CVE-2006-1678

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.80% · Oct 27, 2026

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.8.0.3 allow remote attackers to inject arbitrary web script or HTML via unknown vectors in unspecified scripts in the themes directory.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphpmyadminsid4:5.2.4~dev~git20260809.e0909b211b+dfsg-1fixed
Debianphpmyadminforky4:5.2.4~dev~git20260809.e0909b211b+dfsg-1fixed
Debianphpmyadmintrixie4:5.2.2-really+dfsg-1+deb13u1fixed
Debianphpmyadminbookworm4:5.2.1+dfsg-1+deb12u1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphpmyadminsourcesid4:2.8.0.3-1not yet assignedNot reported[362567]
Debianphpmyadminsourceforky4:2.8.0.3-1not yet assignedNot reported[362567]
Debianphpmyadminsourcetrixie4:2.8.0.3-1not yet assignedNot reported[362567]
Debianphpmyadminsourcebookworm4:2.8.0.3-1not yet assignedNot reported[362567]

[Debian bug #362567]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [phpmyadmin]Fixed
    Details (2)

    • 4:5.2.1+dfsg-1+deb12u1 · all · bookworm

      Fixed · Fixed: 4:2.8.0.3-1

      dsa · phpmyadmin · debian · bookworm; dsa · phpmyadmin · debian · 12

    • 4:5.2.1+dfsg-1+deb12u1 · all · bookworm

      Fixed · Fixed: 4:2.8.0.3-1

      dsa · phpmyadmin · debian · bookworm; dsa · phpmyadmin · debian · 12

[Debian 13 (Trixie)]

  • [phpmyadmin]Fixed
    Details (2)

    • 4:5.2.2-really+dfsg-1+deb13u1 · all · trixie

      Fixed · Fixed: 4:2.8.0.3-1

      dsa · phpmyadmin · debian · 13

    • 4:5.2.2-really+dfsg-1+deb13u1 · all · trixie

      Fixed · Fixed: 4:2.8.0.3-1

      dsa · phpmyadmin · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]