{"id":"GHSA-q586-xpwr-jc3j","aliases":["CVE-2014-5274"],"title":"phpMyAdmin cross-site scripting vulnerability in crafted view name","description":"A cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted view name, related to `js/functions.js`.","severity":"low","score":null,"published":"2022-05-14T02:05:29.000Z","modified":"2023-11-08T03:57:43.389Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"phpmyadmin/phpmyadmin","ranges":[{"events":[{"introduced":"4.1.0"},{"fixed":"4.1.14.3"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.1.14.3"]},{"ecosystem":"Packagist","name":"phpmyadmin/phpmyadmin","ranges":[{"events":[{"introduced":"4.2.0"},{"fixed":"4.2.7.1"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.2.7.1"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2014-5274","https://github.com/phpmyadmin/phpmyadmin/commit/0cd293f5e13aa245e4a57b8d373597cc0e421b6f","http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html","http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php"],"sources":[{"name":"OSV","id":"GHSA-q586-xpwr-jc3j","modified":"2023-11-08T03:57:43.389036Z","url":"https://osv.dev/vulnerability/GHSA-q586-xpwr-jc3j"}],"assessments":[]}