CVE-2026-1194267.7High
phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql
Not in CISA KEVVendor fix available
0.3%probability of exploitation in the next 30 days
20th percentile
050100
Higher than 20% of scored CVEs
7.7HighCVSS
LowMediumHighCrit.
DescriptionNVD
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 3 Nov.
- Seven phpMyAdmin vulnerabilities expose users to account attacksSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.