CVE-2026-119427: phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting

Published Oct 30, 2026

Updated

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped jsonencode() output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other users' designer settings or run controluser subqueries.

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an authenticated phpMyAdmin account with the ability to send requests to the Designer endpoint. Exploitation uses crafted index or value parameters in a request with operation=save_setting_value.

What can a successful exploit do?

The reported impact includes overwriting other users' Designer settings and executing controluser subqueries. The supplied severity vector rates confidentiality and integrity impact as low, with no availability impact.

How can I tell whether my deployment may be affected?

Deployments running phpMyAdmin through 5.2.3 may be affected if authenticated users can access /database/designer and invoke the save_setting_value operation. Review Designer endpoint requests for unusually crafted index or value parameters.

CVE-2026-119427: phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting

Event History

Frequently Asked Questions

Who can exploit this issue?

What can a successful exploit do?

How can I tell whether my deployment may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can a successful exploit do?

How can I tell whether my deployment may be affected?