CVE-2026-119563
MEDIUM
MEDIUM
Priority: 0.00
BB Relevance:
50/100
Published: 2026-10-30
Modified: 2026-10-30
First seen: 2026-10-30
Status: active
Attack Surface
Network
Low Complexity
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
Passive
S:
X
AT:
None
VC:
Low
VI:
Low
VA:
None
Description
phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name contains HTML markup that executes in another user's session when they add a condition on it in Designer query mode.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| phpMyAdmin | phpMyAdmin | 0 |
References & Advisories (4)
third-party-advisory
third-party-advisory
technical-description
product