# CVE-2019-6798: phpmyadmin β€” Fixed in 4.8.5 🐘 🐘 Packagist Not in CISA KEV CRITICAL severity # CVE-2019-6798 β€” phpmyadmin CRITICAL CVE-2019-6798 is a critical-severity (CVSS 9.8) SQL Injection vulnerability in phpmyadmin/phpmyadmin. A fix is available for phpmyadmin/phpmyadmin β€” see the affected versions and patch details below. phpMyAdmin SQL injection in Designer feature Also known as[GHSA-f732-fxh6-g4qj](/vulnerability/GHSA-f732-fxh6-g4qj) Published Jan 26, 2019 Updated Oct 24, 2026 Affected 1 pkg Patched 1 / 1 Exploits None indexed Exploitation data as of Oct 29, 2026 Β· OSV.dev, NVD, FIRST.org (EPSS) ## EPSS Exploitation Probability [via FIRST.org β†—](https://www.first.org/epss/) 3.6%probability of exploitation in next 30 days Lower Risk+0.10% Lower risk than most CVEs89th percentile β€” riskier than 89% of all scored CVEsHighest risk 0.00%1.64%3.28%4.93%0.5%3.6%Apr 26Aug 26Oct 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected 🐘`phpmyadmin/phpmyadmin` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages β€” download data is not available via public APIs for these ecosystems. ## Description An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature. ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix 🐘Packagist `phpmyadmin/phpmyadmin` all versions 4.8.5`composer require phpmyadmin/phpmyadmin:^4.8.5` ## Affected Products 1 product Β· 1 configurations Application `phpmyadmin`phpmyadmin β‰₯ 4.5.0 && ≀ 4.8.4 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for phpmyadmin/phpmyadmin, including transitive dependencies β€” a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update phpmyadmin/phpmyadmin to 4.8.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range β€” O3 confirms CVE-2019-6798 is resolved across your whole dependency graph. 3. ### Workarounds Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs. ## Fixing This On Your OS If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below β€” it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project. UbuntuCRITICAL [USN-4639-1Ubuntu](https://ubuntu.com/security/notices/USN-4639-1)[USN-4843-1Ubuntu](https://ubuntu.com/security/notices/USN-4843-1) ## Frequently Asked Questions An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature. O3 Security Β· Impact-Aware SCA ### Is CVE-2019-6798 in your dependencies? Find it across Packagist, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)