CVE-2015-2206

libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

• CWE-200

• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151331.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151914.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151931.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html
• http://www.debian.org/security/2015/dsa-3382
• http://www.mandriva.com/security/advisories?name=MDVSA-2015:186Broken Link
• http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.phpVendor Advisory
• http://www.securityfocus.com/bid/72949
• http://www.securitytracker.com/id/1031871Third Party Advisory, VDB Entry
• https://github.com/phpmyadmin/phpmyadmin/commit/b2f1e895038a5700bf8e81fb9a5da36cbdea0eeb
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151331.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151914.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151931.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html
• http://www.debian.org/security/2015/dsa-3382
• http://www.mandriva.com/security/advisories?name=MDVSA-2015:186Broken Link
• http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.phpVendor Advisory
• http://www.securityfocus.com/bid/72949
• http://www.securitytracker.com/id/1031871Third Party Advisory, VDB Entry
• https://github.com/phpmyadmin/phpmyadmin/commit/b2f1e895038a5700bf8e81fb9a5da36cbdea0eeb

Published

Mar 9, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-2198Multiple cross-site scripting (XSS) vulnerabilities in edit_…
• CVE-2015-2199Multiple SQL injection vulnerabilities in the WonderPlugin A…
• CVE-2015-2201Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows Vi…7.2
• CVE-2015-2202Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows ad…7.2
• CVE-2015-2203Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticate…
• CVE-2015-2204Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before…
• CVE-2015-2207Multiple cross-site scripting (XSS) vulnerabilities in NetCr…5.4
• CVE-2015-2208The saveObject function in moadmin.php in phpMoAdmin 1.1.2 a…
• CVE-2015-2209DLGuard 4.5 allows remote attackers to obtain the installati…
• CVE-2015-2210The help window in Epicor CRS Retail Store before 3.2.03.01.…
• CVE-2015-2212Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2015-2213SQL injection vulnerability in the wp_untrash_post_comments …