CVE-2026-119563: phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name
phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name contains HTML markup that executes in another user's session when they add a condition on it in Designer query mode.
Event History
Frequently Asked Questions
Who can inject the malicious content?
A database user with CREATE privilege can create a table whose name contains HTML markup. The issue is stored, so the user who triggers execution can be different from the user who created the table.
What user action triggers the payload?
The payload executes when another user adds a condition for the maliciously named table in Designer query mode. This requires interaction by the victim rather than execution solely from table creation.
Which installations should be treated as affected?
phpMyAdmin versions through 5.2.3 are affected according to the available information.