Bringing MySQL to the web


Announcement-ID: PMASA-2013-9

Date: 2013-07-28

Updated: 2013-07-30


5 XSS vulnerabilities in setup, chart display, process list, and logo link.



We consider these vulnerabilities to be non critical.

Mitigation factor

The stored XSS vulnerabilities can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required forms. The setup vulnerabilities can only be triggered when a crafted value is entered by the user.

Affected Versions

Versions 3.5.x (prior to and 4.0.x (prior to are affected.


Upgrade to phpMyAdmin or or newer or apply the patches listed below.


Thanks to Emanuel Bronshtein for reporting these issues.

Assigned CVE ids: CVE-2013-4996 CVE-2013-4997

CWE ids: CWE-661 CWE-79 CWE-80


The following commits have been made to fix this issue:

The following commits have been made on the 3.5 branch to fix this issue:

More information

For further information and in case of questions, please contact the phpMyAdmin team. Our website is