CVE-2026-121261

A vulnerability exists in phpMyAdmin ShapeFile up to version 4.0.1 . The flaw is located in the ShapeRecord::loadFromFile function of the SHP File Handler component. Improper handling during file loading can lead to an infinite loop when manipulated. This vulnerability can be triggered remotely ,...

EUVD-2026-116068

A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Th...

CVE-2026-121262: phpMyAdmin SQL-Parser: A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1

A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is the function parse of the file src/Statements/ExplainStatement.php. Performing a manipulation of the argument nextToken results in incorrect type conversion. The attack is possible to be carried out remotely...

CVE-2026-121263: phpMyAdmin MoTranslator: A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1

A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file motranslator-master/src/Loader.php. Executing a manipulation of the argument locale can lead to path traversal. The attack may be performed from remote. Th...

CVE-2026-121261: phpMyAdmin ShapeFile: A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1

A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Th...

CVE-2026-119563

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display. Attackers can create a table whose name contains HTML markup that executes in another user's sessio...

CVE-2026-119562

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute values to /database/central-columns. Attackers can inject SQL into pmacentralcolumns INSERT and UPDATE queries run with controluser...

CVE-2026-119561

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthnrequestresponse with...

ZmEu

ZmEu CVE-2009-1151, phpMyAdmin's set.up...

PhpMyAdmin

This is an old perl scanner I found for the php my admin exploit that's from 2009. I got bored and figured I would practice perl and learn a bit about an older language and convert it to python. This is for educational purposes mostly because this exploit being well over a decade old I wouldn't...

pocs

minervais.com.phpMyAdminRCE.sh phpMyAdmin '/scripts/setup.php' PHP Code Injection RCE POC. This was the first publicly-released exploit for CVE-2009-1151. Syntax $ ./phpMyAdminRCE.sh usage: ./phpMyAdminRCE.sh i.e.: ./phpMyAdminRCE.sh http://target.tld/phpMyAdmin/ Demo $ ./phpMyAdminRCE.sh...

CVE-2014-9219

CVE-2014-9219 CVE-2014-9219 XSS POC About The vulnerability is caused by an input validation error in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 when processing url parameter. A remote attacker can trick the victim to follow a specially crafted link and execute arbitra...

Linux Distros Unpatched Vulnerability : CVE-2026-119562

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute...

Linux Distros Unpatched Vulnerability : CVE-2026-119563

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped...

Linux Distros Unpatched Vulnerability : CVE-2026-119561

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse that never verifies WebAuthn asserti...

5MMISSI-CVE-2017-1000499

5MMISSI-CVE-2017-1000499 PoC of CVE-2017-1000499 phpMyAdmin versions 4.7.x prior to 4.7.6.1/4.7.7 are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc...

phpmyadmin-importldi

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · phpmyadmin-importldi Write-up: https://abraxaslabs.tech/research/phpmyadmin-importldi phpmyadmin-importldi Class: SQLi Reach: Remote phpMyAdmin 5.2.3 RELEASE523 / 962857e - phpMyAdmin ImportLdi.php builds LOAD DATA wi...

SUSE CVE-2026-119426

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sqlquery to /sql or...

SUSE CVE-2026-119427

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped jsonencode output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other...

SUSE CVE-2026-119428

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching...