Live › vulnerability › CVE-2026-119562
phpMyAdmin through 5.2.3 does not escape the col_extra and col_attribute values sent to /database/central-columns. An logged-in user can inject SQL into queries that run with the controluser account, reading or changing other users' configuration-storage data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Teams that run phpMyAdmin on a server with the configuration storage feature enabled and multiple logged-in users. The attacker needs a valid phpMyAdmin login, so installations with a single trusted user are lower risk. unknown whether a default install is exposed.
No product ranges from the sources yet.
grep -i 'PMA_VERSION' libraries/classes/Version.php or the version shown in the footer.5.2.3 are implied fixed; the sources do not name a specific fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT and UPDATE queries run with controluser privileges, reading or modifying other users' configuration-storage data.
This page as .md · .json · in your agent: get_signal("CVE-2026-119562")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.