Live › vulnerability › CVE-2026-121262
The phpMyAdmin SQL-Parser library (versions 6.0.0 and 6.0.1) mishandles a manipulated argument in its EXPLAIN statement parser, causing an incorrect type conversion. The sources do not state what an attacker gets beyond that, and a public exploit is reported to exist.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Applications that pull in phpMyAdmin SQL-Parser 6.0.0 or 6.0.1 and pass it SQL text that can be influenced from outside, such as query tools or admin consoles. Systems that do not use these versions, or never parse untrusted SQL, are unlikely to be exposed. The sources do not say which parse inputs trigger the flaw beyond the nextToken argument.
No product ranges from the sources yet.
phpmyadmin/sql-parser package, for example with composer show phpmyadmin/sql-parsersrc/Statements/ExplainStatement.php in the vendor directoryNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is the function parse of the file src/Statements/ExplainStatement.php. Performing a manipulation of the argument nextToken results in incorrect type conversion. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121262")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.