phpMyAdmin through version 5.2.3 contains a stored cross‑site scripting flaw that allows any database user with CREATE privilege to inject arbitrary HTML and JavaScript into table names. When such a maliciously crafted table name is used in the Designer query history interface, the unescaped name is rendered in another user’s session, causing client‑side code to execute. The vulnerability does not provide direct code execution on the server but can compromise the victim’s browser context, enabling session hijacking, credential theft, or defacement.

All installations of phpMyAdmin with version 5.2.3 or earlier are affected. The flaw is exploitable for users who have been granted the CREATE privilege on the target database, even if they are not administrators of the phpMyAdmin instance.

The CVSS score of 5.1 indicates a medium severity assessment. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower observed exploitation rate. However, the attack requires the attacker to have database‑level CREATE permissions, which are often granted to application users or shared accounts. If such privileges exist, the vulnerability can be leveraged to inject malicious scripts that run in other users’ browsers when they interact with the Designer feature. The risk is therefore contingent on privilege configuration and the usage patterns of the Designer tool within the environment.