Search
Find a vulnerability
Search criteria
2 vulnerabilities found for MoTranslator by phpMyAdmin
CVE-2026-121263 (GCVE-0-2026-121263)
Vulnerability from nvd – Published: 2026-11-03 17:15 – Updated: 2026-11-03 22:40 X_Open Source
VLAI
EPSS
VEX
Title
phpMyAdmin MoTranslator Loader.php getTranslator path traversal
Summary
A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file motranslator-master/src/Loader.php. Executing a manipulation of the argument locale can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 22:38 UTC
CWE
- CWE-22 - Path Traversal
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430229 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430229/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121263 | third-party-advisory |
| https://vuldb.com/submit/1018559 | third-party-advisory |
| https://gist.github.com/Ishanoshada/42eb6d8737aef… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| phpMyAdmin | MoTranslator |
Affected:
6.0.0
Affected: 6.0.1 cpe:2.3:a:phpmyadmin:motranslator:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121263",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T22:38:11.213647Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:40:59.859Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:phpmyadmin:motranslator:*:*:*:*:*:*:*:*"
],
"product": "MoTranslator",
"vendor": "phpMyAdmin",
"versions": [
{
"status": "affected",
"version": "6.0.0"
},
{
"status": "affected",
"version": "6.0.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ishan Oshada"
},
{
"lang": "en",
"type": "reporter",
"value": "ishanoshada (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "ishanoshada (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file motranslator-master/src/Loader.php. Executing a manipulation of the argument locale can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:15:08.482Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430229 | phpMyAdmin MoTranslator Loader.php getTranslator path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430229"
},
{
"name": "VDB-430229 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430229/cti"
},
{
"name": "CVE-2026-121263 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121263"
},
{
"name": "Submit #1018559 | phpMyAdmin MoTranslator 6.0.1 Path Traversal in Loader::getTranslator (CWE-22)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018559"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/Ishanoshada/42eb6d8737aef38e133afb04fd2e52e8"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T16:50:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "phpMyAdmin MoTranslator Loader.php getTranslator path traversal",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121263",
"datePublished": "2026-11-03T17:15:08.482Z",
"dateReserved": "2026-11-03T10:48:09.163Z",
"dateUpdated": "2026-11-03T22:40:59.859Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121263 (GCVE-0-2026-121263)
Vulnerability from cvelistv5 – Published: 2026-11-03 17:15 – Updated: 2026-11-03 22:40 X_Open Source
VLAI
EPSS
VEX
Title
phpMyAdmin MoTranslator Loader.php getTranslator path traversal
Summary
A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file motranslator-master/src/Loader.php. Executing a manipulation of the argument locale can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 22:38 UTC
CWE
- CWE-22 - Path Traversal
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430229 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430229/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121263 | third-party-advisory |
| https://vuldb.com/submit/1018559 | third-party-advisory |
| https://gist.github.com/Ishanoshada/42eb6d8737aef… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| phpMyAdmin | MoTranslator |
Affected:
6.0.0
Affected: 6.0.1 cpe:2.3:a:phpmyadmin:motranslator:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121263",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T22:38:11.213647Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:40:59.859Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:phpmyadmin:motranslator:*:*:*:*:*:*:*:*"
],
"product": "MoTranslator",
"vendor": "phpMyAdmin",
"versions": [
{
"status": "affected",
"version": "6.0.0"
},
{
"status": "affected",
"version": "6.0.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ishan Oshada"
},
{
"lang": "en",
"type": "reporter",
"value": "ishanoshada (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "ishanoshada (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file motranslator-master/src/Loader.php. Executing a manipulation of the argument locale can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:15:08.482Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430229 | phpMyAdmin MoTranslator Loader.php getTranslator path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430229"
},
{
"name": "VDB-430229 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430229/cti"
},
{
"name": "CVE-2026-121263 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121263"
},
{
"name": "Submit #1018559 | phpMyAdmin MoTranslator 6.0.1 Path Traversal in Loader::getTranslator (CWE-22)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018559"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/Ishanoshada/42eb6d8737aef38e133afb04fd2e52e8"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T16:50:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "phpMyAdmin MoTranslator Loader.php getTranslator path traversal",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121263",
"datePublished": "2026-11-03T17:15:08.482Z",
"dateReserved": "2026-11-03T10:48:09.163Z",
"dateUpdated": "2026-11-03T22:40:59.859Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}