CVE-2026-1195635.4Medium
phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name
Not in CISA KEV
0.2%probability of exploitation in the next 30 days
6th percentile
050100
Higher than 6% of scored CVEs
5.4MediumCVSS
LowMediumHighCrit.
DescriptionNVD
phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name contains HTML markup that executes in another user's session when they add a condition on it in Designer query mode.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 3 Nov.
- Seven phpMyAdmin vulnerabilities expose users to account attacksSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.