CVE-2026-119427

MEDIUM 4.2

phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting

CVSS Score

4.2

EPSS Score

0.0%

EPSS Percentile

0th

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.

CWE	CWE-89
Vendor	phpmyadmin
Product	phpmyadmin
Published	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for phpmyadmin phpmyadmin

Be the first to know when new medium vulnerabilities affecting phpmyadmin phpmyadmin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

phpMyAdmin / phpMyAdmin

0 ≤ 5.2.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/phpmyadmin/phpmyadmin/commit/ec0c6d8394b70d67798f38b645e39c26ea96a2a3 github.com: https://github.com/phpmyadmin/phpmyadmin/commit/8d1244a72b3be073418e0e08f6f5506815bc7e65 github.com: https://github.com/phpmyadmin/phpmyadmin/pull/18698 github.com: https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Database/Designer/Common.php#L788-L808 abraxaslabs.tech: https://abraxaslabs.tech/research/phpmyadmin-designer-json-sqli github.com: https://github.com/phpmyadmin/phpmyadmin vulncheck.com: https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-sql-injection-via-designer-savesetting

Credits

Abraxas Labs Kamil Tekiela