/Vulnerability Library

phpMyAdmin < 5.0.3 - SQL Injection

CVE-2020-26935
Verified

Description

phpMyAdmin before 4.9.6 and 5.x before 5.0.3 contains a SQL injection caused by improper processing of SQL statements in the search feature, letting attackers inject malicious SQL, exploit requires crafted search input.

Severity

Critical

CVSS Score

9.8

Exploit Probability

67%

Published Date

January 21, 2026

Template Author

0x_akoko

CVE-2020-26935.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2020-26935
CWE ID:
cwe-89

References

https://www.phpmyadmin.net/security/PMASA-2020-6/https://github.com/phpmyadmin/phpmyadmin/commit/d09ab9bc9d634ad08b866d42bb8c4109869d38d2https://nvd.nist.gov/vuln/detail/CVE-2020-26935

Remediation Steps

Update to phpMyAdmin 4.9.6 or 5.0.3, or latest version.