SQL Injection Vulnerability in phpMyAdmin Affects Database Management
CVE-2026-119562

2.3LOW

Key Information:

Vendor

PHPmyadmin
Status
PHPmyadmin
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119562?

An SQL injection vulnerability exists in phpMyAdmin versions up to 5.2.3, allowing authenticated users to exploit the system by supplying unescaped col_extra and col_attribute values to the /database/central-columns endpoint. This can lead to unauthorized SQL code execution in pma__central_columns INSERT and UPDATE queries, which are executed with controluser privileges. Malicious actors can leverage this flaw to gain access to or modify other users' configuration-storage data, thereby jeopardizing the integrity and confidentiality of information managed by the database.

Affected Version(s)

phpMyAdmin 0 <= 5.2.3

References

https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2...
technical-description
https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2...
technical-description
https://abraxaslabs.tech/research/phpmyadmin-pmadb-centra...
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abraxas Labs
.