CVE-2026-119428

3.7 LOWpublic exploit available

Published 2026-10-30 · Updated 2026-10-30

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-918

Public exploit & PoC references

https://github.com/phpmyadmin/phpmyadmin
https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Config/Validator.php#L241
https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/setup/validate.php#L21-L35
https://github.com/phpmyadmin/phpmyadmin/commit/126ac3ac5662ed3171ef3646636348fad3f8e952
https://github.com/phpmyadmin/phpmyadmin/commit/510e442593af5d4702bbb46cdb45ad51f3a8a9d3
https://github.com/phpmyadmin/phpmyadmin/pull/19156

All references

https://abraxaslabs.tech/research/phpmyadmin-setup-validate
https://github.com/phpmyadmin/phpmyadmin
https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Config/Validator.php#L241
https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/setup/validate.php#L21-L35
https://github.com/phpmyadmin/phpmyadmin/commit/126ac3ac5662ed3171ef3646636348fad3f8e952
https://github.com/phpmyadmin/phpmyadmin/commit/510e442593af5d4702bbb46cdb45ad51f3a8a9d3
https://github.com/phpmyadmin/phpmyadmin/pull/19156
https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-ssrf-via-setup-validate-php-after-setup-disabled

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2020-37278PoC
HIGHCVE-2023-54402PoC
MEDIUMCVE-2024-34319
HIGHCVE-2025-14260
UNSCOREDCVE-2026-0311
LOWCVE-2026-100104
MEDIUMCVE-2026-100251
MEDIUMCVE-2026-100257

Related by shared AI tags and CWE weakness class. Browse the full archive.