CVE-2026-119426

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119426", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-30T02:41:14.307Z", "datePublished": "2026-10-30T11:30:55.817Z", "dateUpdated": "2026-10-30T16:06:24.241Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-30T11:30:55.817Z"}, "datePublic": "2026-10-23T00:00:00.000Z", "title": "phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql", "descriptions": [{"lang": "en", "value": "phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "affected": [{"vendor": "phpMyAdmin", "product": "phpMyAdmin", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "5.2.3", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:composer/phpmyadmin/phpmyadmin", "repo": "https://github.com/phpmyadmin/phpmyadmin"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*", "versionEndIncluding": "5.2.3"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d1e2b54b530685c24dd91181b9f64a5a64621789", "tags": ["patch"]}, {"url": "https://github.com/phpmyadmin/phpmyadmin/commit/910322373f14ed4601c85234858f630f127569ef", "tags": ["patch"]}, {"url": "https://github.com/phpmyadmin/phpmyadmin/pull/20569", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Common.php#L87-L151", "tags": ["technical-description"]}, {"url": "https://abraxaslabs.tech/research/phpmyadmin-csrf-sql", "tags": ["third-party-advisory"]}, {"url": "https://github.com/phpmyadmin/phpmyadmin", "tags": ["product"]}, {"name": "VulnCheck Advisory: phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-csrf-token-bypass-via-non-ajax-post-to-sql"}], "credits": [{"lang": "en", "value": "Abraxas Labs", "type": "finder"}, {"lang": "en", "value": "Kamil Tekiela", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T16:06:14.646686Z", "id": "CVE-2026-119426", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T16:06:24.241Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119426", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-30T16:06:14.646686Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T16:06:20.318Z"}}], "cna": {"title": "phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql", "credits": [{"lang": "en", "type": "finder", "value": "Abraxas Labs"}, {"lang": "en", "type": "remediation developer", "value": "Kamil Tekiela"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://github.com/phpmyadmin/phpmyadmin", "vendor": "phpMyAdmin", "product": "phpMyAdmin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.2.3"}], "packageURL": "pkg:composer/phpmyadmin/phpmyadmin", "defaultStatus": "unaffected"}], "datePublic": "2026-10-23T00:00:00.000Z", "references": [{"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d1e2b54b530685c24dd91181b9f64a5a64621789", "tags": ["patch"]}, {"url": "https://github.com/phpmyadmin/phpmyadmin/commit/910322373f14ed4601c85234858f630f127569ef", "tags": ["patch"]}, {"url": "https://github.com/phpmyadmin/phpmyadmin/pull/20569", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Common.php#L87-L151", "tags": ["technical-description"]}, {"url": "https://abraxaslabs.tech/research/phpmyadmin-csrf-sql", "tags": ["third-party-advisory"]}, {"url": "https://github.com/phpmyadmin/phpmyadmin", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-csrf-token-bypass-via-non-ajax-post-to-sql", "name": "VulnCheck Advisory: phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "Cross-Site Request Forgery (CSRF)"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "5.2.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-30T11:30:55.817Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119426", "state": "PUBLISHED", "dateUpdated": "2026-10-30T16:06:24.241Z", "dateReserved": "2026-10-30T02:41:14.307Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-30T11:30:55.817Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:composer/phpmyadmin/phpmyadmin", "product": "phpMyAdmin", "repo": "https://github.com/phpmyadmin/phpmyadmin", "vendor": "phpMyAdmin", "versions": [{"lessThanOrEqual": "5.2.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*", "matchCriteriaId": "0AD0A6C1-DA53-4144-A399-C5750EDF8B5B", "versionEndIncluding": "5.2.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication."}], "id": "CVE-2026-119426", "lastModified": "2026-11-03T16:08:41.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119426", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T16:06:14.646686Z", "version": "2.0.3"}}]}, "published": "2026-10-30T12:16:39.683", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://abraxaslabs.tech/research/phpmyadmin-csrf-sql"}, {"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://github.com/phpmyadmin/phpmyadmin"}, {"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Common.php#L87-L151"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/phpmyadmin/phpmyadmin/commit/910322373f14ed4601c85234858f630f127569ef"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/phpmyadmin/phpmyadmin/commit/d1e2b54b530685c24dd91181b9f64a5a64621789"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/phpmyadmin/phpmyadmin/pull/20569"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-csrf-token-bypass-via-non-ajax-post-to-sql"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "phpMyAdmin: phpMyAdmin: Arbitrary SQL execution via CSRF token bypass", "id": "2563934", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563934"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-346", "details": ["phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.", "A flaw was found in phpMyAdmin. A remote attacker can execute arbitrary database queries by bypassing cross-site request forgery (CSRF) token validation on standard HTTP POST requests. By tricking an authenticated user into submitting a crafted cross-site request, an attacker can execute SQL commands with the privileges of the victim's database account."], "name": "CVE-2026-119426", "public_date": "2026-10-30T11:30:55Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119426\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119426\nhttps://abraxaslabs.tech/research/phpmyadmin-csrf-sql\nhttps://github.com/phpmyadmin/phpmyadmin\nhttps://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Common.php#L87-L151\nhttps://github.com/phpmyadmin/phpmyadmin/commit/910322373f14ed4601c85234858f630f127569ef\nhttps://github.com/phpmyadmin/phpmyadmin/commit/d1e2b54b530685c24dd91181b9f64a5a64621789\nhttps://github.com/phpmyadmin/phpmyadmin/pull/20569\nhttps://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-csrf-token-bypass-via-non-ajax-post-to-sql"], "statement": "Important impact is assigned to this flaw because unauthorized database commands can be triggered within the context of an authenticated session, potentially resulting in complete compromise of database integrity and confidentiality. Although exploitation hinges on tricking an active user into submitting a forged submission, the full database privileges granted to an administrative victim elevate the risk beyond Moderate severity. phpMyAdmin is not distributed in supported Red Hat Enterprise Linux releases, though it is distributed via community repositories such as EPEL.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.2.3]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "phpMyAdmin", "source": "cna", "vendor": "phpMyAdmin"}, "product": "phpmyadmin", "vendor": "phpmyadmin"}], "created": "2026-10-30T13:00:15.127155+00:00", "updated": "2026-11-04T10:45:12.287964+00:00", "vendors": ["phpmyadmin", "phpmyadmin$PRODUCT$phpmyadmin"]}