{"id":"CVE-2026-119427","title":"phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting","summary":"phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operat…","severity":"medium","cvss":4.2,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-89"],"vendor":"phpMyAdmin","product":"phpMyAdmin","affected":["phpMyAdmin <= 5.2.3"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-04T15:06:57.005452Z"},"published":"2026-10-30","updated":"2026-11-04","sourceUpdated":"2026-11-04T15:07:12.105Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119427","references":[{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/ec0c6d8394b70d67798f38b645e39c26ea96a2a3"},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/8d1244a72b3be073418e0e08f6f5506815bc7e65"},{"url":"https://github.com/phpmyadmin/phpmyadmin/pull/18698"},{"url":"https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Database/Designer/Common.php#L788-L808"},{"url":"https://abraxaslabs.tech/research/phpmyadmin-designer-json-sqli"},{"url":"https://github.com/phpmyadmin/phpmyadmin"},{"url":"https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-sql-injection-via-designer-savesetting","label":"VulnCheck Advisory: phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting"}],"tags":["cve.org"],"epss":0.00316,"epssPercentile":0.24608,"ingestedAt":"2026-11-03T10:42:03.642Z","slug":"CVE-2026-119427","body":"## Overview\n\nphpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.\n\n## Affected\n\n- `phpMyAdmin <= 5.2.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":23.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}