---
id: CVE-2026-119563
title: phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name
summary: >-
  phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability
  that allows database users with CREATE privilege to inject script via
  unescaped table names in DesignerHistory.display(). Attackers can create a
  table whose na…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: phpMyAdmin
product: phpMyAdmin
affected:
  - phpMyAdmin <= 5.2.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:21:08.158715Z'
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:21:22.984Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119563'
references:
  - url: >-
      https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/js/src/designer/history.js#L85-L86
  - url: 'https://abraxaslabs.tech/research/phpmyadmin-vqb-xss'
  - url: 'https://github.com/phpmyadmin/phpmyadmin'
  - url: >-
      https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-stored-xss-via-designer-query-history-table-name
    label: >-
      VulnCheck Advisory: phpMyAdmin through 5.2.3 Stored XSS via Designer Query
      History Table Name
tags:
  - cve.org
epss: 0.00203
epssPercentile: 0.10349
ingestedAt: '2026-11-03T11:43:15.775Z'
---

## Overview

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name contains HTML markup that executes in another user's session when they add a condition on it in Designer query mode.

## Affected

- `phpMyAdmin <= 5.2.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.