SQL Injection in phpMyAdmin Affects Designer Functionality
CVE-2026-119427

2.3LOW

Key Information:

Vendor

PHPmyadmin
Status
PHPmyadmin
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119427?

phpMyAdmin versions up to 5.2.3 are susceptible to an SQL injection vulnerability that occurs within the Designer module during the saving of user settings. This vulnerability primarily enables authenticated users to craft specific index or value parameters while employing the operation=save_setting_value method. By sending manipulated parameters to the /database/designer endpoint, attackers can potentially overwrite the designer settings of other users or execute subqueries that affect database control users. This issue stems from the improper handling of unescaped output produced by the json_encode function.

Affected Version(s)

phpMyAdmin 0 <= 5.2.3

References

https://github.com/phpmyadmin/phpmyadmin/commit/ec0c6d839...
patch
https://github.com/phpmyadmin/phpmyadmin/commit/8d1244a72...
patch
https://github.com/phpmyadmin/phpmyadmin/pull/18698
patchissue-tracking

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abraxas Labs
Kamil Tekiela
.