PT-2026-133480
CVE-2026-119427
·
Published
2026-10-30
·
Updated
2026-10-30
Description by
CVSS 3.1
4.2
MediumMetricsAV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json encode() output. Attackers can send crafted index or value parameters with operation=save setting value to /database/designer to overwrite other users' designer settings or run controluser subqueries.
Found an issue in the description? Have something to add? Feel free to write us 👾