phpMyAdmin CVE-2026-119563

Attacker must be an authenticated phpMyAdmin/database user who holds the CREATE privilege, which is needed to create a table whose name contains HTML markup (PR:L). The payload only fires when a second (victim) user opens that table in Designer query mode and adds a condition on it, causing the unescaped table name to be rendered by DesignerHistory.display() (history.js L85-L86) - so successful exploitation requires victim interaction within the Designer feature (UI:P). Limiting factors: the CREATE privilege prerequisite confines this to insiders or multi-tenant/shared-hosting setups, the Designer query-mode workflow must actually be used by a higher-value victim, and impact is script execution in the victim's phpMyAdmin session rather than direct server code execution. Affects phpMyAdmin through 5.2.3.

This is a medium-severity stored XSS (vendor CVSS 4.0 base 5.1) whose real-world urgency is moderate, not critical. The vendor 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) shows it is network-reachable and low-complexity, but it requires an authenticated attacker holding the CREATE privilege (PR:L) and depends on victim interaction (UI:P) - a second user opening Designer query mode and adding a condition on the attacker's maliciously named table. Impact metrics are all Low (VC:L/VI:L/VA:N with subsequent-system SC:L/SI:L), consistent with script execution in another user's phpMyAdmin session rather than full server compromise. The vuln.today priority is 'this_month' (not act_now/emergency), and there is no CISA KEV listing and no EPSS score supplied, so there is no signal of active or widespread exploitation. PoC signal is present but weak: the input references a VulnCheck advisory and an abraxaslabs research writeup, which are documentation/PoC references rather than confirmed working exploit code. Net: a legitimate issue to remediate on a normal patch cycle, gated heavily by the CREATE-privilege prerequisite and the need for victim interaction - this is a privileged-user-abuse / insider-or-shared-hosting risk, not a mass-exploitable unauthenticated bug.

On a shared phpMyAdmin deployment, a low-privileged database user who holds the CREATE privilege creates a table whose name embeds HTML/JavaScript markup. When an administrator or another user later opens that table in Designer query mode and adds a condition on it, the unescaped table name is rendered by DesignerHistory.display() and the attacker's script executes in the victim's authenticated session. A public PoC reference exists (abraxaslabs research and VulnCheck advisory); it is not verified as working exploit code. Exploitation is low-complexity but requires both the CREATE privilege and the victim's interaction with the Designer.