CVE-2026-119563— phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name

Quick assessment

Affected

phpMyAdmin phpMyAdmin

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

phpMyAdmin 5.2.3 及更早版本存在存储型跨站脚本（XSS）漏洞。拥有 CREATE 权限的数据库用户可以利用 DesignerHistory.display() 函数中未转义的表名，注入恶意脚本。攻击者可创建包含 HTML 标记的表名，当其他用户在 Designer 查询模式中对这些表添加条件时，该脚本将在其会话中执行。

CVSS 5.4 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name

Source: CVE Program / CVE List V5

Vulnerability Description

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name contains HTML markup that executes in another user's session when they add a condition on it in Designer query mode.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
phpMyAdmin	phpMyAdmin	0 ~ 5.2.3	-

II. Public POCs for CVE-2026-119563

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119563

请登录查看更多情报信息。

Other References for CVE-2026-119563 (4)

https://abraxaslabs.tech/research/phpmyadmin-vqb-xss third-party-advisory
https://github.com/phpmyadmin/phpmyadmin product
https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/js/src/designer/history.js#L85-L86 technical-description
https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-stored-xss-via-designer-query-history-table-name third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119563

Same Patch Batch · phpMyAdmin · 2026-10-30 · 7 CVEs total

CVE-2026-119426	7.5 HIGH	phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql
CVE-2026-119561	6.8 MEDIUM	phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer
CVE-2026-119429	4.3 MEDIUM	phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set
CVE-2026-119427	4.2 MEDIUM	phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting
CVE-2026-119562	4.2 MEDIUM	phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute
CVE-2026-119428	3.7 LOW	phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled

IV. Related Vulnerabilities

Same product: phpMyAdmin

Same vendor: phpMyAdmin

Same weakness: CWE-79