DEBIAN-CVE-2026-121262

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-121262
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-121262.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-121262
Upstream
  • CVE-2026-121262
Published
2026-11-03T17:18:08Z
Modified
2026-11-06T17:29:21Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
[none]
Details

A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is the function parse of the file src/Statements/ExplainStatement.php. Performing a manipulation of the argument nextToken results in incorrect type conversion. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

Affected packages

Debian:12 / phpmyadmin-sql-parser

Package

Name
phpmyadmin-sql-parser
Purl
pkg:deb/debian/phpmyadmin-sql-parser?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

5.*
5.7.0-2
5.8.2-1
5.9.0-1
5.9.1-1
5.10.0-1
5.10.2-1
5.10.3-1~bpo12+1
5.10.3-1
5.10.3-2
5.11.2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-121262.json"

Debian:13 / phpmyadmin-sql-parser

Package

Name
phpmyadmin-sql-parser
Purl
pkg:deb/debian/phpmyadmin-sql-parser?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

5.*
5.10.3-2
5.11.2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-121262.json"

Debian:14 / phpmyadmin-sql-parser

Package

Name
phpmyadmin-sql-parser
Purl
pkg:deb/debian/phpmyadmin-sql-parser?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

5.*
5.10.3-2
5.11.2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-121262.json"