Description
Multiple cross-site scripting (XSS) vulnerabilities in PhpMyAdmin before 2.9.1.1 allow remote attackers to inject arbitrary HTML or web script via (1) a comment for a table name, as exploited through (a) db_operations.php, (2) the db parameter to (b) db_create.php, (3) the newname parameter to db_operations.php, the (4) query_history_latest, (5) query_history_latest_db, and (6) querydisplay_tab parameters to (c) querywindow.php, and (7) the pos parameter to (d) sql.php.
Remediation
References
Related Vulnerabilities
WordPress Plugin Two Way CHAT-Send or receive messages to your user Multiple Vulnerabilities (3.1.4)
WordPress Plugin Advance Menu Manager Cross-Site Request Forgery (2.9.6)
WordPress Plugin wp-football Multiple Cross-Site Scripting Vulnerabilities (1.1)
WordPress Plugin CM Download Manager Multiple Vulnerabilities (2.0.6)