Live › vulnerability › CVE-2026-119427
phpMyAdmin through 5.2.3 fails to escape JSON output in the Designer saveSetting() function, so SQL can be injected through the index or value parameters. An authenticated user can overwrite other users' Designer settings or run queries against the controluser database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Any server running phpMyAdmin 5.2.3 or older where users have logins to the web interface. The flaw needs an authenticated account, so exposure is lower where phpMyAdmin is limited to administrators or behind extra access control. Teams that run phpMyAdmin only on a private network with trusted users face less risk.
No product ranges from the sources yet.
phpMyAdmin --version or the version shown in the footer) and see whether it is 5.2.3 or older/database/designer with operation=save_setting_value in the web server access logs5.2.3; the sources do not name the fixed releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.
This page as .md · .json · in your agent: get_signal("CVE-2026-119427")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.