CVE-2008-4326: phpMyAdmin

Medium severity, CVSS 4.3. EPSS: 1.9% chance of exploitation in the next 30 days.

The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via a NUL byte inside a "</script" sequence.

Affected products

• phpMyAdmin phpMyAdmin: up to and including 2.11.9.1; version 2.0 only; version 2.0.0 only; version 2.0.1 only; version 2.0.2 only; version 2.0.3 only; …

Published 2008-09-30. Last modified 2026-06-16.