# CVE-2026-119562: phpMyAdmin SQL injection in central columns

Source: https://junglewise.ai/threats/cve-2026-119562-phpmyadmin-through-5-2-3-contains-an-sql-injection-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119562 · Severity: medium · CVSS 4.2 · Published 2026-10-30

phpMyAdmin is a web interface for managing MySQL and MariaDB databases. An authenticated user can inject malicious SQL commands through unescaped fields in the central columns feature, potentially reading or modifying other users' database configuration data stored with elevated database privileges.

Technologies: [phpMyAdmin](https://junglewise.ai/threats/technologies/phpmyadmin). Vendors: [phpMyAdmin](https://junglewise.ai/threats/vendors/phpmyadmin).

## Quick answers

**Is CVE-2026-119562 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119562 being exploited in the wild.

**How severe is CVE-2026-119562?** Medium severity, with a CVSS score of 4.2, published 30 October 2026.

**Which products and versions are affected?** phpMyAdmin through 5.2.3.

**Is there a fix for CVE-2026-119562?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-119562 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-119562?** Check whether you run phpMyAdmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

SQL injection in the central columns feature (col_extra and col_attribute fields) of phpMyAdmin 5.2.3 allows authenticated users to inject SQL because these fields are concatenated directly into INSERT and UPDATE queries without proper escaping, while neighboring fields are properly escaped. The injected SQL executes with controluser privileges against the pmadb configuration-storage database, potentially exposing or modifying configuration data of other users. The vulnerability requires authentication and POST access to /database/central-columns endpoint, with exploitation confirmed in a controlled lab environment running phpMyAdmin 5.2.3 with pmadb enabled.

## Affected products

- phpMyAdmin phpMyAdmin through 5.2.3

## Timeline

- 2026-10-12: disclosed: Public disclosure by Abraxas Labs
- 2026-10-30: advisory

## References

- [https://abraxaslabs.tech/research/phpmyadmin-pmadb-central-sqli](https://abraxaslabs.tech/research/phpmyadmin-pmadb-central-sqli)
- [https://github.com/phpmyadmin/phpmyadmin](https://github.com/phpmyadmin/phpmyadmin)

## Related threats

- [phpMyAdmin stored cross-site scripting in Designer history](https://junglewise.ai/threats/cve-2026-119563-phpmyadmin-through-5-2-3-contains-a-stored-cross-site-scripting)
- [phpMyAdmin WebAuthn signature verification bypass in CustomServer](https://junglewise.ai/threats/cve-2026-119561-phpmyadmin-through-5-2-3-contains-an-authentication-bypass)
- [phpMyAdmin missing re-authentication in config preference removal](https://junglewise.ai/threats/cve-2026-119429-phpmyadmin-through-5-2-3-contains-a-missing-re-authentication)
- [phpMyAdmin SQL injection in Designer saveSetting()](https://junglewise.ai/threats/cve-2026-119427-phpmyadmin-through-5-2-3-contains-an-sql-injection-vulnerability)
- [phpMyAdmin CSRF token bypass allows SQL execution](https://junglewise.ai/threats/cve-2026-119426-phpmyadmin-through-5-2-3-contains-a-cross-site-request-forgery)