CVE-2015-6830
NoneCVSS
—
EPSS
10.4%
Published
Sep 14, 2015
CISA due date
—
The record
libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | phpmyadmin/phpmyadmin | 4.3.0 | 4.3.13.2 |
| Packagist | phpmyadmin/phpmyadmin | 4.4.0 | 4.4.14.1 |
| Debian:11 | phpmyadmin | 0 | 4:4.4.14.1-1 |
| Debian:12 | phpmyadmin | 0 | 4:4.4.14.1-1 |
| Debian:13 | phpmyadmin | 0 | 4:4.4.14.1-1 |
| Debian:7 | phpmyadmin | 0 | 4:3.4.11.1-2+deb7u2 |
| Debian:8 | phpmyadmin | 0 | 4:4.2.12-2+deb8u1 |
| Mageia:4 | phpmyadmin | 0 | 4.2.13.3-1.1.mga4 |
| Mageia:5 | phpmyadmin | 0 | 4.2.13.3-1.1.mga5 |
| Ubuntu:16.04:LTS | phpmyadmin | 0 | 4:4.5.0.2-2 |
| openSUSE:Tumbleweed | phpMyAdmin | 0 | 4.6.5.2-1.1 |
| packagist | phpmyadmin/phpmyadmin | 4.3.0 | No fix |
| packagist | phpmyadmin/phpmyadmin | 4.4.0 | No fix |
Related vulnerabilities
- CVE-2025-24530 An issue was discovered in phpMyAdmin 5.x before 5.2.2. Also affects phpmyadmin/phpmyadmin
- CVE-2016-5734 phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not… Also affects phpmyadmin/phpmyadmin
- CVE-2011-4107 The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php)… Also affects phpmyadmin/phpmyadmin
- CVE-2011-2505 libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in… Also affects phpmyadmin/phpmyadmin
- CVE-2025-24529 An issue was discovered in phpMyAdmin 5.x before 5.2.2. Also affects phpmyadmin
- CVE-2014-9218 libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and… Also affects phpmyadmin
- CVE-2010-3055 The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before… Also affects phpmyadmin
- CVE-2009-1285 Static code injection vulnerability in the getConfigFile function in… Also affects phpmyadmin