6902 matches found
PT-2026-133480
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped json encode output. Attackers can send crafted index or value parameters with operation=save setting value to /database/designer to overwrite other...
phpMyAdmin -- Multiple vulnerabilities, no fix available
VulnCheck reports: Seven vulnerabilities in phpMyAdmin up to and including 5.2.3 were published on 2026-10-30. The most severe of them, an authentication bypass, is in the WebAuthn second factor: assertion signatures are never verified against the stored public keys, so an attacker who already ha...
PT-2026-133482
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, strippi...
PT-2026-133479
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql query to /sql or...
CVE-2026-119561: phpMyAdmin: phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in…
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthnrequestresponse with...
CVE-2026-119428: phpMyAdmin: phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to…
phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching...
PT-2026-133500
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col extra and col attribute values to /database/central-columns. Attackers can inject SQL into pma central columns INSERT and UPDATE queries run with controluser...
CVE-2026-119562: phpMyAdmin: phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by…
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute values to /database/central-columns. Attackers can inject SQL into pmacentralcolumns INSERT and UPDATE queries run with controluser...
PT-2026-133499
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn request response wit...
PT-2026-133481
phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching...
CVE-2026-119563: phpMyAdmin: phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE…
phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display. Attackers can create a table whose name contains HTML markup that executes in another user's sessio...
PT-2026-133501
phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display. Attackers can create a table whose name contains HTML markup that executes in another user's sessio...
PMA-5.2.3-WebAuthn-2FA
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · PMA-5.2.3-WebAuthn-2FA PMA-5.2.3-WebAuthn-2FA phpMyAdmin 5.2.3 - phpMyAdmin Default tarball. web-auth/webauthn-lib is suggest / require-dev. composer install --no-dev does not install it. createServer therefore uses...
PhpMyAdmin Scripts - Remote Code Execution
PhpMyAdmin Scripts 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 are susceptible to a remote code execution in setup.php that allows remote attackers to inject arbitrary PHP code into a configuration file via the save action. Combined with the ability to save files on server, this can allow...
PhpMyAdmin <4.8.2 - Local File Inclusion
PhpMyAdmin before version 4.8.2 is susceptible to local file inclusion that allows an attacker to include view and potentially execute files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted...
phpmyadmin-importldi
abraxaslabs.tech · github.com/abraxas ·&...
phpmyadmin-auth-plugin-unquoted
abraxaslabs.tech · github.com/abraxas ·&...
phpmyadmin-vqb-xss
abraxaslabs.tech · github.com/abraxas ·&...
phpMyAdmin 4.8.1 Local File Inclusion
phpMyAdmin version 4.8.1 contains a local file inclusion vulnerability in index.php target handling. A proof of concept demonstrates bypassing the page whitelist through double URL encoding to include local files. https://packetstorm.news/download/234987...