CVE-2026-119429

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, strippi...

CVE-2026-119428

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching...

DEBIAN-CVE-2026-119427

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped jsonencode output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other...

CVE-2026-119426

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sqlquery to /sql or...

CVE-2026-119427

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped jsonencode output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other...

CVE-2026-119426

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sqlquery to /sql or...

CVE-2026-119428

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching...

CVE-2026-119563

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display. Attackers can create a table whose name contains HTML markup that executes in another user's sessio...

CVE-2026-119561

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthnrequestresponse with...

CVE-2026-119427

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped jsonencode output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other...

EUVD-2026-113828

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display. Attackers can create a table whose name contains HTML markup that executes in another user's sessio...

CVE-2026-119563

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display. Attackers can create a table whose name contains HTML markup that executes in another user's sessio...

CVE-2026-119563 phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display. Attackers can create a table whose name contains HTML markup that executes in another user's sessio...

CVE-2026-119563

phpMyAdmin versions through 5.2.3 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the failure to escape table names within the DesignerHistory.display() function. Database users with CREATE privileges can inject malicious HTML markup into a table name, which then exe...

CVE-2026-119563 phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display. Attackers can create a table whose name contains HTML markup that executes in another user's sessio...

CVE-2026-119563

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display. Attackers can create a table whose name contains HTML markup that executes in another user's sessio...

CVE-2026-119562

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute values to /database/central-columns. Attackers can inject SQL into pmacentralcolumns INSERT and UPDATE queries run with controluser...

EUVD-2026-113827

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute values to /database/central-columns. Attackers can inject SQL into pmacentralcolumns INSERT and UPDATE queries run with controluser...

CVE-2026-119562

phpMyAdmin versions through 5.2.3 are vulnerable to an SQL injection flaw within the central columns interface. An authenticated user can supply unescaped col_extra and col_attribute values to /database/central-columns, causing the application to execute malicious SQL during pma__central_columns ...

CVE-2026-119562 phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute values to /database/central-columns. Attackers can inject SQL into pmacentralcolumns INSERT and UPDATE queries run with controluser...