DEBIAN-CVE-2026-119426
Dashboard / Vulnerabilities / DEBIAN-CVE-2026-119426
Summary:
Details: phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.
Affected packages
Package
Name: phpmyadmin
Purl: pkg:deb/debian/phpmyadmin?arch=source&distro=bookworm
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -None
Affected versions
4:5.2.1+dfsg-1
4:5.2.1+dfsg-1+deb12u1
4:5.2.1+dfsg-2
4:5.2.1+dfsg-3
4:5.2.1+dfsg-4
4:5.2.2-dev+759fe912a-1
4:5.2.2-really+dfsg-1
4:5.2.2-really+dfsg-2
4:5.2.2-really5.2.2+20241130+dfsg-1
4:5.2.2-really5.2.2+20241228+dfsg-1
4:5.2.2-really5.2.2+20250114+dfsg-1
4:5.2.2-really5.2.2+20250121+dfsg-1
4:5.2.3+dfsg-1
4:5.2.4~dev~git20260809.e0909b211b+dfsg-1
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
