phpMyAdmin vulnerabilities
We track 6 vulnerabilities in phpMyAdmin products. 6 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on October 30, 2026.
Latest phpMyAdmin vulnerabilities
- 8.8 High severity
phpMyAdmin: Improper Neutralization of Special Elements used in an SQL Command
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT and
- 8.1 High severity
phpMyAdmin: Improper Verification of Cryptographic Signature
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST
- 8.8 High severity
phpMyAdmin: Improper Neutralization of Special Elements used in an SQL Command
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value
- 8.8 High severity
phpMyAdmin: Cross-Site Request Forgery
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POS
- 7.5 High severity
phpMyAdmin: Exposure of Sensitive Information to an Unauthorized Actor
PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.
- 9.8 Critical severity
phpMyAdmin Remote Code Execution Exploited
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.