CVE-2019-25451
phpMoAdmin 1.1.5 Cross-Site Request Forgery via moadmin.php
- State
- Published
- Severity
- 5.3 Medium
- Published
- Feb 20, 2026
- Updated
- Apr 7, 2026
- Reserved
- Feb 20, 2026
Description
phpMoAdmin 1.1.5 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized database operations by crafting malicious requests. Attackers can trick authenticated users into submitting GET requests to moadmin.php with parameters like action, db, and collection to create, drop, or repair databases and collections without user consent.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
phpMoAdminPhpmoadmin |
|
References
- ExploitDB-46082exploit
- phpMoAdmin Official Websiteproduct
- VulnCheck Advisory: phpMoAdmin 1.1.5 Cross-Site Request Forgery via moadmin.phpthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.