CVE-2011-4107

The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

• CWE-611

• http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.htmlMailing List, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.htmlMailing List, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.htmlMailing List, Third Party Advisory
• http://osvdb.org/76798Broken Link
• http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txtBroken Link, Exploit
• http://seclists.org/fulldisclosure/2011/Nov/21Exploit, Mailing List, Third Party Advisory
• http://secunia.com/advisories/46447Broken Link, Vendor Advisory
• http://securityreason.com/securityalert/8533Broken Link
• http://www.debian.org/security/2012/dsa-2391Mailing List
• http://www.mandriva.com/security/advisories?name=MDVSA-2011:198Broken Link
• http://www.openwall.com/lists/oss-security/2011/11/03/3Mailing List
• http://www.openwall.com/lists/oss-security/2011/11/03/5Mailing List
• http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.phpPatch, Vendor Advisory
• http://www.securityfocus.com/bid/50497Broken Link, Third Party Advisory, VDB Entry
• http://www.wooyun.org/bugs/wooyun-2010-03185Broken Link, Exploit
• https://bugzilla.redhat.com/show_bug.cgi?id=751112Exploit, Issue Tracking
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71108Third Party Advisory, VDB Entry
• http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.htmlMailing List, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.htmlMailing List, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.htmlMailing List, Third Party Advisory
• http://osvdb.org/76798Broken Link
• http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txtBroken Link, Exploit
• http://seclists.org/fulldisclosure/2011/Nov/21Exploit, Mailing List, Third Party Advisory
• http://secunia.com/advisories/46447Broken Link, Vendor Advisory
• http://securityreason.com/securityalert/8533Broken Link
• http://www.debian.org/security/2012/dsa-2391Mailing List
• http://www.mandriva.com/security/advisories?name=MDVSA-2011:198Broken Link
• http://www.openwall.com/lists/oss-security/2011/11/03/3Mailing List
• http://www.openwall.com/lists/oss-security/2011/11/03/5Mailing List
• http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.phpPatch, Vendor Advisory
• http://www.securityfocus.com/bid/50497Broken Link, Third Party Advisory, VDB Entry
• http://www.wooyun.org/bugs/wooyun-2010-03185Broken Link, Exploit
• https://bugzilla.redhat.com/show_bug.cgi?id=751112Exploit, Issue Tracking
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71108Third Party Advisory, VDB Entry

Published

Nov 17, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-4101The dissect_infiniband_common function in epan/dissectors/pa…
• CVE-2011-4102Heap-based buffer overflow in the erf_read_header function i…
• CVE-2011-4103emitters.py in Django Piston before 0.2.3 and 0.2.x before 0…
• CVE-2011-4104The from_yaml method in serializers.py in Django Tastypie be…
• CVE-2011-4105LightDM before 1.0.6 allows local users to change ownership …
• CVE-2011-4106TimThumb (timthumb.php) before 2.0 does not validate the ent…
• CVE-2011-4108The DTLS implementation in OpenSSL before 0.9.8s and 1.x bef…
• CVE-2011-4109Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, wh…
• CVE-2011-4110The user_update function in security/keys/user_defined.c in …
• CVE-2011-4111Buffer overflow in the ccid_card_vscard_handle_message funct…
• CVE-2011-4112The net subsystem in the Linux kernel before 3.1 does not pr…5.5
• CVE-2011-4113SQL injection vulnerability in the Views module before 6.x-2…