phpMyAdmin has 7 CVEs on record. Disclosure cadence is accelerating: 10 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 7. The median CVSS is 4.8 (medium). None have a confirmed exploitation report. Most affected products: phpMyAdmin (7), MoTranslator (1), SQL-Parser (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.8
- Publish → KEV
- —
- Last 90 days
- 10 prev 0
Products
- phpMyAdmin 7
- MoTranslator 1
- SQL-Parser 1
- ShapeFile 1
Worst active — by depth score
CVE-2026-119426High· 7.5phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql41CVE-2026-119561Medium· 6.8phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer37CVE-2026-119563Medium· 5.4phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name30CVE-2026-119429Medium· 4.3phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set24CVE-2026-119562Medium· 4.2phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute23
phpMyAdmin vulnerabilities
CVEs affecting phpMyAdmin, newest first. Open any entry for full detail, references, and exploit status.
10 CVEsRSS
CVE-2026-121263Medium· 6.3PoCphpMyAdmin MoTranslator Loader.php getTranslator path traversal
A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file motranslator-master/src/Loader.php. Executing a manipulation of the argument locale can lead to…
CVE-2026-121262Medium· 5.3phpMyAdmin SQL-Parser ExplainStatement.php parse type conversion
A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is the function parse of the file src/Statements/ExplainStatement.php. Performing a manipulation of the argument nextToken results in incorrect type con…
CVE-2026-121261Medium· 4.3phpMyAdmin ShapeFile SHP File loadFromFile infinite loop
A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The …
CVE-2026-119561Medium· 6.8phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQ…
CVE-2026-119426High· 7.5phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into su…
CVE-2026-119429Medium· 4.3phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit ke…
CVE-2026-119563Medium· 5.4phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name
phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose na…
CVE-2026-119562Medium· 4.2phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__cen…
CVE-2026-119428Low· 3.7PoCphpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled
phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker…
CVE-2026-119427Medium· 4.2phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operat…