VULNERABILITY INTELLIGENCE
CVE-2011-2506
CVSS score7.5 HIGH
EPSS probability9.63%
CISA KEVNot currently listed
Published2011-07-14
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Description
setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.
Weakness classification
- CWE-94: Improper Control of Generation of Code ('Code Injection')