Section

Vulnerabilities

CVE records from NVD, ZDI advisories and the CISA KEV catalog, with CVSS, EPSS, SSVC and exploitation state.

7 matching records.

1. 21
   CVE NVD 45h ago

   phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF…

   phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims…

   CVSS 7.5 CVE-2026-119426 PhpMyAdmin Web platform
2. 20
   CVE NVD 45h ago

   phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies…

   phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a…

   CVSS 6.8 CVE-2026-119561 PhpMyAdmin Database
3. 20
   CVE NVD 45h ago

   phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication…

   phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can…

   CVSS 4.3 CVE-2026-119429 PhpMyAdmin Database
4. 14
   CVE NVD 45h ago

   phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via…

   phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table…

   CVSS 5.4 CVE-2026-119563 PhpMyAdmin Web platform
5. 14
   CVE NVD 45h ago

   phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and…

   phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into…

   CVSS 4.2 CVE-2026-119562 PhpMyAdmin Web platform
6. 14
   CVE NVD 45h ago

   phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via…

   phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters…

   CVSS 4.2 CVE-2026-119427 PhpMyAdmin Web platform
7. 11
   CVE NVD 45h ago

   phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections…

   phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST…

   CVSS 3.7 CVE-2026-119428 PhpMyAdmin Web platform

Same filters as JSON: /api/items?category=vuln&window=30d&vendor=PhpMyAdmin&limit=100. RSS for this section: feed.xml.