CVE-2020-10803: Debian Linux

Medium severity, CVSS 5.4. EPSS: 1.4% chance of exploitation in the next 30 days.

In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.

Affected products

• Debian Debian Linux: version 8.0 only
• Fedoraproject Fedora: version 30 only; version 31 only; version 32 only
• Opensuse Backports Sle: version 15.0 only
• Opensuse Leap: version 15.1 only
• phpMyAdmin phpMyAdmin: from 4.0.0, before 4.9.5 (fixed in 4.9.5); from 5.0.0, before 5.0.2 (fixed in 5.0.2)
• Suse Package Hub: affected versions not specified

Published 2020-03-22. Last modified 2026-06-17.