Live › vulnerability › CVE-2026-119426
phpMyAdmin through 5.2.3 skips its CSRF token check on some non-AJAX POST requests, so a malicious page can make a logged-in user's browser submit SQL to /sql or /database/sql. The attacker then runs arbitrary SQL with the victim's database privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Teams running phpMyAdmin 5.2.3 or older with http or config authentication, where a logged-in administrator can be lured to a malicious page. Exposure is lower if phpMyAdmin is only reachable on an internal network and access is restricted. Installations that are not running phpMyAdmin can skip this.
No product ranges from the sources yet.
config.inc.php or the package manager, and see whether it is 5.2.3 or older.http or config authentication.5.2.3; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.
This page as .md · .json · in your agent: get_signal("CVE-2026-119426")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.