CVE-2020-26935
highpriority · attend · 62EPSS 0.657 · 99 %ileEURUUSEPSS · scored 2026-10-27
An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (25)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-7ff4-cv53-4cjqphpMyAdmin SQL injection vulnerability2022-05-24ghsa · osvUS
An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.
- BIT-phpmyadmin-2020-269352024-03-06vendor · osvUS
An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (34)
External citations — patches, advisories, analysis.
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.htmlcnnvd
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.htmlcnnvd
- https://advisory.checkmarx.net/advisory/CX-2020-4281cnnvd
- https://github.com/phpmyadmin/phpmyadmin/commit/d09ab9bc9d634ad08b866d42bb8c4109869d38d2Patchcnnvd
- https://lists.debian.org/debian-lts-announce/2020/10/msg00024.htmlcnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K/cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO/cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5/cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan