UBUNTU-CVE-2026-119563: Medium severity ubuntu/phpmyadmin vulnerability
phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name contains HTML markup that executes in another user's session when they add a condition on it in Designer query mode.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
phpMyAdmin users who use Designer query mode may be exposed if an attacker with database CREATE privilege can create a table with a malicious HTML-containing name. The script executes in the session of a user who adds a condition on that table in Designer query mode.
What access does an attacker need to exploit it?
The attacker needs database-level CREATE privilege to create a table with a crafted name. Exploitation also requires a separate user to interact with that table by adding a condition in Designer query mode.
Are installations affected by default?
The available information does not establish whether Designer query mode is enabled or used by default. Exploitation depends on both a user having CREATE privilege and another user performing the specified Designer action.
How can I determine whether exploitation may have occurred?
Review table names created by users with CREATE privilege for embedded HTML markup, especially in databases accessed through phpMyAdmin. Also review use of Designer query mode involving conditions added to unusually named tables.