Vulnerabilities

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via…

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

PhpMyAdmin

Product

phpMyAdmin

CVSS v3.1

4.2 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness

CWE-89

Exposure class

Web platform

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-119427 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 14
   CVE NVD 45h ago

   phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and…

   CVSS 4.2 CVE-2026-119562 PhpMyAdmin