CVE-2026-119427 phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting

What is CVE-2026-119427?

CVE-2026-119427 is a low-severity vulnerability in phpMyAdmin, published on 30 Oct 2026.

Official description

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.

Weakness: CWE-89

Which versions are affected by CVE-2026-119427?

It affects 1 product.

Products include phpMyAdmin.

How do I fix CVE-2026-119427?

No fix has been published for CVE-2026-119427 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-119427 being exploited?

There is no known exploitation of CVE-2026-119427 in the wild and no public exploit code.

Other vulnerabilities in phpMyAdmin

• CVE-2008-7251 libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 creates a temporary directory with 0777 permissions, which has unknown impact and attack vectors. Critical 10.0
• CVE-2008-7252 phpMyAdmin unsafely handles temporary files Critical 10.0
• CVE-2007-0203 Multiple unspecified vulnerabilities in phpMyAdmin before 2.9.2-rc1 have unknown impact and attack vectors. Critical 10.0
• CVE-2004-1147 phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary c Critical 10.0
• CVE-2020-22452 phpmyadmin contains SQL Injection vulnerability Critical 9.8

All phpMyAdmin vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-119427, GHSA-23wc-rmw7-463f, UBUNTU-CVE-2026-119427.