Threats affecting pkg:composer/phpMyAdmin

phpMyAdmin versions up to 5.2.3 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows database users with CREATE privileges to inject malicious scripts via unescaped table names in the DesignerHistory.display() function. When another user interacts with the affected table name in Designer query mode, the injected script executes in their session.

CVE-2026-119562 is an SQL injection vulnerability in phpMyAdmin versions up to 5.2.3. Authenticated users can exploit this flaw by supplying unescaped col_extra and col_attribute values to the /database/central-columns endpoint. This allows injection of SQL commands into INSERT and UPDATE queries executed with controluser privileges, potentially enabling unauthorized reading or modification of other users' configuration-storage data.

phpMyAdmin versions up to 5.2.3 have an authentication bypass vulnerability due to improper verification of WebAuthn assertion signatures. This flaw allows attackers who already possess a victim's MySQL credentials to bypass the second-factor authentication by submitting a crafted WebAuthn response, thereby gaining unauthorized database access.

CVE-2026-119429 is a vulnerability in phpMyAdmin up to version 5.2.3 that allows authenticated attackers to bypass two-factor authentication (2FA). By sending a specially crafted request to the /config/set endpoint with a null JSON value for the 2FA key, an attacker with a hijacked session can remove 2FA protection. This causes subsequent logins to require only the MySQL password, weakening account security.

CVE-2026-119428 is a server-side request forgery (SSRF) vulnerability in phpMyAdmin versions up to 5.2.3. It allows unauthenticated attackers to send crafted POST requests to setup/validate.php, which lacks proper access restrictions. This can lead to outbound MySQL-protocol connections to attacker-specified hosts and ports, enabling internal port probing via error messages.

phpMyAdmin versions up to 5.2.3 contain an SQL injection vulnerability in the Designer saveSetting() function. Authenticated users can exploit this flaw by sending crafted parameters to the /database/designer endpoint, potentially overwriting other users' designer settings or executing controluser subqueries. The vulnerability arises from improper neutralization of special elements in SQL commands via unescaped json_encode() output.

A cross-site request forgery (CSRF) vulnerability exists in phpMyAdmin versions up to and including 5.2.3. This flaw allows remote attackers to bypass CSRF token checks on non-AJAX POST requests, enabling execution of arbitrary SQL commands with the privileges of an authenticated victim. The attack requires the victim to be authenticated and can be triggered by submitting crafted cross-site POST requests to specific phpMyAdmin endpoints.

phpMyAdmin versions 5.0.0 through 5.2.1 contain a cross-site scripting (XSS) vulnerability in the check tables feature. This flaw allows an attacker to craft a table or database name that triggers XSS when viewed. The vulnerability is fixed in version 5.2.2.