Live › vulnerability › CVE-2026-119563
phpMyAdmin through 5.2.3 does not escape table names when showing Designer query history, so a database user who can create tables can plant script in a name. When another user adds a condition on that table in Designer query mode, the script runs in their session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Teams that run phpMyAdmin for shared MySQL or MariaDB servers where some users can create tables. Single-admin installs where only trusted people hold CREATE privilege are at much lower risk. The sources do not describe a fixed version.
No product ranges from the sources yet.
libraries/classes/Version.php in the install directory.5.2.3 (the sources do not name the fixed release).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name contains HTML markup that executes in another user's session when they add a condition on it in Designer query mode.
This page as .md · .json · in your agent: get_signal("CVE-2026-119563")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.