CVE-2026-119427
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.
Risk Assessment
An authenticated attacker can modify other users' configuration and execute unauthorized SQL queries, potentially compromising data integrity. However, a valid phpMyAdmin account is required.
Recommendation
Update phpMyAdmin to a patched version and restrict user account privileges to the necessary minimum.
Other vulnerabilities in phpMyAdmin
See all- CVE-2017-1000018High
phpMyAdmin versions 4.0, 4.4, and 4.6 are vulnerable to a DoS attack in the replication status by using a specially crafted table name.
- CVE-2017-1000017High
phpMyAdmin versions 4.0, 4.4, and 4.6 are vulnerable to a weakness that allows a user with appropriate permissions to connect to an arbitrary MySQL server.
- CVE-2017-1000014High
phpMyAdmin versions 4.0, 4.4, and 4.6 are vulnerable to a DoS weakness in the table editing functionality.
- CVE-2016-6621High
The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
- CVE-2016-9864High
An issue was discovered in phpMyAdmin that allows SQL injection via a crafted username or table name in the tracking functionality. The executed statements run with the privileges of the control user, granting access to configuration storage database tables and, if the control user has the necessary privileges, to some MySQL database tables.
- CVE-2016-9863High
An issue was discovered in phpMyAdmin that allows for a Denial of Service (DoS) attack through a very large request to the table partitioning function. All 4.6.x versions prior to 4.6.5 are affected.
- CVE-2016-9862High
An issue was discovered in phpMyAdmin that allows for BBCode injection on the login page via a crafted login request. All 4.6.x versions (prior to 4.6.5) are affected.
- CVE-2016-9861High
An issue was discovered in phpMyAdmin related to the limitation in URL matching, allowing for the bypass of URL white-list protection. This affects versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18).
- CVE-2016-6633High
An issue was discovered in phpMyAdmin that can lead to remote code execution in certain PHP installations running with the dbase extension. This affects versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17).
- CVE-2016-6631High
An issue was discovered in phpMyAdmin that allows for remote code execution when the application is run as CGI. A user can pass a query string that is executed as a command-line argument by the file generator_plugin.sh.
Original NVD description (English source)
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS