CVE-2019-25453 MEDIUM

CVE-2019-25453: phpMoAdmin 1.1.5 Reflected Cross-Site Scripting via moadmin.php

Vendor Phpmoadmin
Product phpMoAdmin
Weakness CWE-79 · XSS
Published February 20, 2026
Last update April 7, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

phpMoAdmin 1.1.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the newdb parameter. Attackers can craft URLs with JavaScript payloads in the newdb parameter of moadmin.php to execute arbitrary code in users' browsers when they visit the malicious link.

Key dates

02Disclosure timeline

February 20, 2026 CVE published
April 7, 2026 Record updated