CVE-2026-119563phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name

Description

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name contains HTML markup that executes in another user's session when they add a condition on it in Designer query mode.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/js/src/designer/history.js#L85-L86 technical-descriptionProduct
• https://abraxaslabs.tech/research/phpmyadmin-vqb-xss third-party-advisoryExploitMitigationThird Party Advisory
• https://github.com/phpmyadmin/phpmyadmin productProduct
• VulnCheck Advisory: phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name third-party-advisoryExploitThird Party Advisory