CVE-2026-119428

A flaw was found in phpMyAdmin. This Server-Side Request Forgery SSRF vulnerability allows an unauthenticated remote attacker to trigger outbound network connections by submitting custom host and port values to the setup validation script. By inspecting the returned connection error messages, an...

CVE-2026-119561

A flaw was found in phpMyAdmin. This issue allows a remote attacker with valid database credentials to bypass two-factor authentication 2FA. The application fails to verify Web Authentication WebAuthn cryptographic assertion signatures against stored public keys during login. An attacker can...

CVE-2026-119563

A flaw was found in phpMyAdmin. This stored cross-site scripting XSS vulnerability allows an authenticated database user with table creation privileges to execute arbitrary script in another user's browser session. By creating a database table with a name containing malicious markup, the unescape...

CVE-2026-119562

A flaw was found in phpMyAdmin. An authenticated user can exploit a Structured Query Language SQL injection vulnerability by submitting unescaped parameters to the central columns interface. Because these inputs are processed into database queries executed with elevated control user privileges, a...

CVE-2026-119427

A flaw was found in phpMyAdmin. An authenticated remote attacker can exploit a Structured Query Language SQL injection vulnerability in the Designer component by submitting crafted parameters when saving configuration settings. This issue allows the attacker to execute unintended database queries...

CVE-2026-119429

A flaw was found in phpMyAdmin. An authenticated remote attacker can disable two-factor authentication 2FA on an account by submitting a configuration update request without being prompted for password re-verification. An attacker with access to an active session can exploit this issue to remove...

CVE-2026-119426

A flaw was found in phpMyAdmin. A remote attacker can execute arbitrary database queries by bypassing cross-site request forgery CSRF token validation on standard HTTP POST requests. By tricking an authenticated user into submitting a crafted cross-site request, an attacker can execute SQL comman...

CVE-2026-119561

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthnrequestresponse with...

CVE-2026-119562

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute values to /database/central-columns. Attackers can inject SQL into pmacentralcolumns INSERT and UPDATE queries run with controluser...

DEBIAN-CVE-2026-119562

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute values to /database/central-columns. Attackers can inject SQL into pmacentralcolumns INSERT and UPDATE queries run with controluser...

DEBIAN-CVE-2026-119561

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthnrequestresponse with...

DEBIAN-CVE-2026-119563

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display. Attackers can create a table whose name contains HTML markup that executes in another user's sessio...

CVE-2026-119563

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display. Attackers can create a table whose name contains HTML markup that executes in another user's sessio...

CVE-2026-119429

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, strippi...

CVE-2026-119428

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching...

CVE-2026-119427

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped jsonencode output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other...

CVE-2026-119426

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sqlquery to /sql or...

DEBIAN-CVE-2026-119427

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped jsonencode output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other...

CVE-2026-119426

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sqlquery to /sql or...

CVE-2026-119428

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching...