CVE-2026-119563 in phpMyAdmin
Summary
by MITRE • 10/30/2026
phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name contains HTML markup that executes in another user's session when they add a condition on it in Designer query mode.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The identified vulnerability resides within phpMyAdmin versions through 5.2.3 and is classified as a stored cross-site scripting flaw, specifically designated under the Common Weakness Enumeration identifier CWE-79 for Improper Neutralization of Input During Web Page Generation. This security defect allows an attacker to inject malicious client-side scripts into web pages viewed by other users. The root cause lies in the insufficient sanitization and encoding of user-supplied input when it is stored within the database schema, particularly concerning table names that are subsequently rendered in the DesignerHistory.display() function without proper HTML entity escaping.
The operational mechanism of this exploit requires an attacker to possess at least CREATE privileges on the target MySQL or MariaDB server. By leveraging these permissions, a malicious actor can create a new database table with a name containing embedded HTML markup and JavaScript code. Because phpMyAdmin stores metadata about recent design activities in its history tables, the unescaped table name is persisted within the application's data store. When another user accesses the Designer interface to add conditions or perform queries involving this specific table, the stored malicious payload is retrieved from the database and rendered directly into the browser context without adequate validation.
This vulnerability facilitates a persistent attack vector where the injected script executes automatically in the victim's web session upon page load. The impact of such an execution can be severe, potentially leading to the theft of sensitive information such as session cookies, authentication tokens, or personal data stored within phpMyAdmin interfaces. Furthermore, if the compromised user has administrative privileges, the attacker could escalate their access by manipulating interface elements, redirecting users to phishing sites, or executing arbitrary commands that compromise the integrity and confidentiality of the database management environment. The attack aligns with MITRE ATT&CK techniques related to Client-Side Script Injection, specifically leveraging stored payloads for persistent access and data exfiltration.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Administrators should immediately upgrade phpMyAdmin to version 5.2.4 or later, where this input validation issue has been resolved by implementing strict output encoding in the DesignerHistory module. In environments where upgrading is not immediately feasible, restricting CREATE privileges for database users who do not strictly require them can significantly reduce the attack surface. Additionally, enforcing Content Security Policy headers on the phpMyAdmin deployment can help mitigate the impact of any successful injection attempts by preventing unauthorized script execution from untrusted sources. Regular security audits and code reviews focusing on input handling in web applications are essential to prevent similar vulnerabilities arising from improper neutralization of special characters during rendering processes.