CVE-2014-4987: server_user_groups.php in phpMyAdmin 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6 allows remote authenticat...

Security readout for executives and security teams

This phpMyAdmin issue lets a logged-in remote user see the MySQL user list when access controls should block it. The provided sources do not show unauthenticated access, code execution, or confirmed active exploitation. It matters because user enumeration can help attackers map database privileges and plan follow-on attacks. Exposure is likely limited to environments running the named phpMyAdmin versions with authenticated users. Risk increases when phpMyAdmin is reachable from untrusted networks or shared with low-privilege users. The provided affected product metadata is incomplete and listed as n/a. Treat as a medium-priority remediation item unless phpMyAdmin is internet-facing or used by many semi-trusted users. It is not described as a takeover bug, but it exposes sensitive account information that can support broader compromise. Mitigation focus: Upgrade phpMyAdmin beyond 4.1.14.2 or 4.2.6, as applicable.; Check phpMyAdmin vendor guidance and distribution advisories before deployment.; Restrict phpMyAdmin access to trusted administrative networks..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.