CVE-2026-1194274.2Medium
phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting
Not in CISA KEVVendor fix available
0.2%probability of exploitation in the next 30 days
13th percentile
050100
Higher than 13% of scored CVEs
4.2MediumCVSS
LowMediumHighCrit.
DescriptionNVD
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 3 Nov.
- Seven phpMyAdmin vulnerabilities expose users to account attacksSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.