CVE-2026-119562: phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute

Published Oct 30, 2026

Updated

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute values to /database/central-columns. Attackers can inject SQL into pmacentralcolumns INSERT and UPDATE queries run with controluser privileges, reading or modifying other users' configuration-storage data.

Event History

Oct 30, 2026

CVE Published

via MITRE·11:31 AM

Data Sourced

via MITRE·11:31 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs to be authenticated to phpMyAdmin and able to submit crafted col_extra or col_attribute values to the /database/central-columns endpoint. The attack complexity is rated high.

What data or actions are exposed if exploitation succeeds?

Injected SQL is executed in INSERT or UPDATE queries against pma__central_columns using controluser privileges. This can allow reading or modifying other users' configuration-storage data.

Which installations are affected?

phpMyAdmin versions through 5.2.3 are affected. The vulnerable functionality involves Central Columns and the configuration-storage table pma__central_columns.

CVE-2026-119562: phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute

Event History

Frequently Asked Questions

Who can exploit this issue?

What data or actions are exposed if exploitation succeeds?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What data or actions are exposed if exploitation succeeds?

Which installations are affected?