CVE-2026-119562
phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT and UPDATE queries run with controluser privileges, reading or modifying other users' configuration-storage data.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT and UPDATE queries run with controluser privileges, reading or modifying other users' configuration-storage data.
- Record
CVE-2026-119562- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-89
- Updated
- 2026-11-04
EUVDEUVD-2026-113827
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT and UPDATE queries run with controluser privileges, reading or modifying other users' configuration-storage data.
- Record
EUVD-2026-113827- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-q9rr-6m77-6xg8
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users...
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT and UPDATE queries run with controluser privileges, reading or modifying other users' configuration-storage data.
- Record
GHSA-q9rr-6m77-6xg8- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
NVD
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT and UPDATE queries run with controluser privileges, reading or modifying other users' configuration-storage data.
- Record
CVE-2026-119562- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-05
OSV
phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT and UPDATE queries run with controluser privileges, reading or modifying other users' configuration-storage data.
- Record
CVE-2026-119562- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-89
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-119562
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT and UPDATE queries run with controluser privileges, reading or modifying other users' configuration-storage data.
- Record
DEBIAN-CVE-2026-119562- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSVUBUNTU-CVE-2026-119562
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT and UPDATE queries run with controluser privileges, reading or modifying other users' configuration-storage data.
- Record
UBUNTU-CVE-2026-119562- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmyadminDebian:12 |
All versions, plus listed versions 4:5.2.1+dfsg-14:5.2.1+dfsg-1+deb12u14:5.2.1+dfsg-24:5.2.1+dfsg-34:5.2.1+dfsg-4 Show 9 moreShow less4:5.2.2-dev+759fe912a-14:5.2.2-really+dfsg-14:5.2.2-really+dfsg-24:5.2.2-really5.2.2+20241130+dfsg-14:5.2.2-really5.2.2+20241228+dfsg-14:5.2.2-really5.2.2+20250114+dfsg-14:5.2.2-really5.2.2+20250121+dfsg-14:5.2.3+dfsg-14:5.2.4~dev~git20260809.e0909b211b+dfsg-1 |
None known |
phpmyadminDebian:13 |
All versions, plus listed versions 4:5.2.2-really+dfsg-14:5.2.2-really+dfsg-1+deb13u14:5.2.2-really+dfsg-24:5.2.3+dfsg-14:5.2.4~dev~git20260809.e0909b211b+dfsg-1 |
None known |
phpmyadminDebian:14 |
All versions, plus listed versions 4:5.2.2-really+dfsg-14:5.2.2-really+dfsg-24:5.2.3+dfsg-14:5.2.4~dev~git20260809.e0909b211b+dfsg-1 |
None known |
phpmyadminUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 4:4.0.6-14:4.0.8-14:4.0.9-14:4.0.10-14:4.0.10-1ubuntu0.1 Show 4 moreShow less4:4.0.10-1ubuntu0.1+esm14:4.0.10-1ubuntu0.1+esm24:4.0.10-1ubuntu0.1+esm34:4.0.10-1ubuntu0.1+esm4 |
None known |
phpmyadminUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 4:4.4.13.1-14:4.5.0.2-24:4.5.1-14:4.5.1-24:4.5.1-3 Show 13 moreShow less4:4.5.2-14:4.5.2-24:4.5.3.1-14:4.5.4-14:4.5.4.1-24:4.5.4.1-2ubuntu14:4.5.4.1-2ubuntu24:4.5.4.1-2ubuntu2.14:4.5.4.1-2ubuntu2.1+esm24:4.5.4.1-2ubuntu2.1+esm34:4.5.4.1-2ubuntu2.1+esm44:4.5.4.1-2ubuntu2.1+esm54:4.5.4.1-2ubuntu2.1+esm6 |
None known |
phpmyadminUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4:4.6.6-54:4.6.6-5ubuntu0.2+esm14:4.6.6-5ubuntu0.2+esm24:4.6.6-5ubuntu0.54:4.6.6-5ubuntu0.5+esm1 |
None known |
phpmyadminUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4:4.9.1+dfsg1-24:4.9.2+dfsg1-14:4.9.5+dfsg1-1ubuntu14:4.9.5+dfsg1-24:4.9.5+dfsg1-2ubuntu0.1~esm1 |
None known |
phpmyadminUbuntu:22.04:LTS |
All versions, plus listed versions 4:5.0.4+dfsg2-2ubuntu54:5.1.1+dfsg1-5ubuntu1 |
None known |
phpmyadminUbuntu:24.04:LTS |
All versions, plus listed versions 4:5.2.1+dfsg-1ubuntu14:5.2.1+dfsg-2ubuntu14:5.2.1+dfsg-2ubuntu24:5.2.1+dfsg-3 |
None known |
phpmyadminUbuntu:26.10 |
All versions, plus listed versions 4:5.2.3+dfsg-14:5.2.4~dev~git20260809.e0909b211b+dfsg-1 |
None known |
phpmyadminUbuntu:26.04:LTS |
All versions, plus listed versions 4:5.2.2-really+dfsg-24:5.2.3+dfsg-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| facts, references | NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-119562 is a low vulnerability (CVSS 2.3) in Phpmyadmin, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. No source names a fixed version.
References
github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Database/CentralColumns.php
abraxaslabs.tech/research/phpmyadmin-pmadb-central-sqli
vulncheck.com/advisories/phpmyadmin-through-5.2.3-sql-injection-via-central-columns-col-extra-and-col-attribute
nvd.nist.gov/vuln/detail/CVE-2026-119562