Live › vulnerability › CVE-2026-119428
phpMyAdmin through 5.2.3 has a setup validation page that does not check whether setup is disabled, so anyone can make the server open connections to hosts and ports they choose. An attacker can use the returned error messages to map which internal ports are open.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Any server running phpMyAdmin 5.2.3 or earlier where the setup directory is reachable from the network, since the flaw is in the unguarded setup/validate.php page. Installs that remove the setup directory or block it at the web server are likely not reachable through this path, but the sources do not confirm this.
No product ranges from the sources yet.
phpMyAdmin version shown in the footer or config.inc.php; versions through 5.2.3 are in the affected range.setup/ directory is reachable from the internet on the phpMyAdmin host.5.2.3; the exact fixed version is not stated in the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages.
This page as .md · .json · in your agent: get_signal("CVE-2026-119428")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.