CVE-2009-1151: phpMyAdmin Remote Code Execution Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 96.6% chance of exploitation in the next 30 days.

Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.

Affected products

• Debian Debian Linux: version 4.0 only; version 5.0 only
• phpMyAdmin phpMyAdmin: from 2.11.0, before 2.11.9.5 (fixed in 2.11.9.5); from 3.0.0, before 3.1.3.1 (fixed in 3.1.3.1)

Published 2009-03-26. Last modified 2026-06-16.