CVE-2020-10802: Debian Linux

High severity, CVSS 8.0. EPSS: 1.8% chance of exploitation in the next 30 days.

In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.

Affected products

• Debian Debian Linux: version 8.0 only
• Fedoraproject Fedora: version 30 only; version 31 only; version 32 only
• Opensuse Backports Sle: version 15.0 only
• Opensuse Leap: version 15.1 only
• phpMyAdmin phpMyAdmin: from 4.0.0, before 4.9.5 (fixed in 4.9.5); from 5.0.0, before 5.0.2 (fixed in 5.0.2)
• Suse Package Hub: affected versions not specified

Published 2020-03-22. Last modified 2026-06-17.