Bug 2563951 (CVE-2026-119563)

Summary: CVE-2026-119563 phpMyAdmin: phpMyAdmin: Stored cross-site scripting via unescaped table names in Designer query mode
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in phpMyAdmin. This stored cross-site scripting (XSS) vulnerability allows an authenticated database user with table creation privileges to execute arbitrary script in another user's browser session. By creating a database table with a name containing malicious markup, the unescaped name is rendered when another user interacts with the table in Designer query mode. Successful exploitation could lead to unauthorized actions or the disclosure of sensitive session data.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2565549, 2565550, 2565551, 2565552, 2565554    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-30 12:06:15 UTC 
phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name contains HTML markup that executes in another user's session when they add a condition on it in Designer query mode.