I actually have a publicly available so I was shocked by this at first so thought I'd go through that page.I think it says 'no auth' because phpMyAdmin can be configured so you don't need to authenticate? Looking at vulnerabilities since 2010:* CVE-2010-3055, CVE-2011-2506 - code exec - Your unconfigured publicly available phpMyAdmin install's setup is vulnerable with certain server configs* CVE-2012-5159 - 'code exec' - a korean sourceforge mirror of the 3.5.2.2 codebase had a trojan in it that allowed code exec that 400 people downloaded* CVE-2016-5703 - sql injection - says no auth but it's a vuln in functions that get the columns for a table.* CVE-2016-5734 - code exec - The poc shows a password is required: 'parser.add_argument('-p', '-pwd', required=True'* CVE-2016-6620 - 'code exec' - The patch shows unserialize is only used for parsing a schema snapshot (and 'code execution' using this vuln is a stretch, you can run a class destructor with arbitrary variables and destructors rarely do anything exploitable)* CVE-2016-9849 - auth bypass - You're vulnerable to this if you have a root account with no password and are running an old version of php where empty(chr(0).

Download phpmyadmin postgresql