CVE-2026-119427
Phpmyadmin: SQL injection
- Risk score
- 60/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer se…
- Affected
- Phpmyadmin
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Public proof of concept
Story map
At a glance
Phpmyadmin: Amber, patch this week. phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can execute arbitrary SQL with the victim's database privileges.
The flaws
- CVE-2026-119427: SQL injection (CVSS 8.8 · EPSS 0%)
- CVE-2026-119426: Cross-site request forgery (CVSS 8.8 · EPSS 0%)
- CVE-2026-119562: SQL injection (CVSS 8.8 · EPSS 0%)
- CVE-2026-119561: Authentication bypass (CVSS 8.1 · EPSS 0%)
The fix
Fix: Upgrade to a version greater than 5.2.3
Who is exposed: {'products': ['phpMyAdmin'], 'packages': [], 'versions': ['5.2.3']}
Where it stands
- Public proof of concept
Connects to
- Same weakness: SQL injection (CWE-89). 399 other warnings in 30 days
- Same product: Earlier Phpmyadmin warnings. 3 in the last 90 days
Why it is Amber
- CVSS 8.8 high
- Public exploit or proof of concept referenced
References
- https://abraxaslabs.tech/research/phpmyadmin-designer-json-sqli
- https://github.com/phpmyadmin/phpmyadmin
- https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Database/Designer/Common.php#L788-L808
- https://github.com/phpmyadmin/phpmyadmin/commit/8d1244a72b3be073418e0e08f6f5506815bc7e65
- https://github.com/phpmyadmin/phpmyadmin/commit/ec0c6d8394b70d67798f38b645e39c26ea96a2a3
- https://github.com/phpmyadmin/phpmyadmin/pull/18698
- https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-sql-injection-via-designer-savesetting
Original description
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.
Last activity 30 Oct 2026. Patch Forecast updates every hour.