{"id":"CVE-2026-119428","title":"phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled","summary":"phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-918"],"vendor":"phpMyAdmin","product":"phpMyAdmin","affected":["phpMyAdmin <= 5.2.3"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:17:37.881440Z"},"exploitAvailable":true,"published":"2026-10-30","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:17:53.977Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119428","references":[{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/510e442593af5d4702bbb46cdb45ad51f3a8a9d3"},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/126ac3ac5662ed3171ef3646636348fad3f8e952"},{"url":"https://github.com/phpmyadmin/phpmyadmin/pull/19156"},{"url":"https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/setup/validate.php#L21-L35"},{"url":"https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Config/Validator.php#L241"},{"url":"https://abraxaslabs.tech/research/phpmyadmin-setup-validate"},{"url":"https://github.com/phpmyadmin/phpmyadmin"},{"url":"https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-ssrf-via-setup-validate-php-after-setup-disabled","label":"VulnCheck Advisory: phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled"}],"tags":["cve.org","exploit-available"],"epss":0.0034,"epssPercentile":0.2758,"ingestedAt":"2026-11-03T11:43:15.770Z","slug":"CVE-2026-119428","body":"## Overview\n\nphpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages.\n\n## Affected\n\n- `phpMyAdmin <= 5.2.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":32,"depthScoreParts":{"impact":20.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":234865,"id":"CVE-2026-119428","ts":1793918455656,"field":"exploit_available","old":"false","new":"true"}]}