CVE-2026-1194286.3Medium
phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled
Not in CISA KEVVendor fix available
0.3%probability of exploitation in the next 30 days
24th percentile
050100
Higher than 24% of scored CVEs
6.3MediumCVSS
LowMediumHighCrit.
DescriptionNVD
phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 3 Nov.
- Seven phpMyAdmin vulnerabilities expose users to account attacksSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.