🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVE

CVE-2009-1151

9.8

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

Updated Sep 22, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~15 seconds

CVE-2009-1151 Scanner

CVE-2009-1151 scanner - Code Injection vulnerability in phpMyAdmin

Used 2.9k times · 5.9k assets checked · domain, ipv4, subdomain

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →