CVE-2014-4986: Multiple cross-site scripting (XSS) vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1,...

Security readout for executives and security teams

CVE-2014-4986 is an authenticated XSS flaw in phpMyAdmin. A logged-in user could cause malicious script or HTML to run in another user’s browser through crafted table or column names shown in an AJAX confirmation message. Business impact is mainly admin-session compromise or unauthorized actions within phpMyAdmin. Exposure is likely where affected phpMyAdmin versions remain deployed and authenticated database users can create or influence table or column names. Internet-facing phpMyAdmin increases business risk, but the provided sources require authentication for exploitation. Treat as a moderate priority unless phpMyAdmin is internet-facing or shared with semi-trusted users. Patch during normal vulnerability remediation windows, with faster action for exposed administrative interfaces. Mitigation focus: Upgrade phpMyAdmin to 4.0.10.1, 4.1.14.2, 4.2.6, or later.; Apply vendor package updates from distributions such as openSUSE or Gentoo where relevant.; Restrict phpMyAdmin access to trusted networks, VPN, or administrative users..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.