Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action.

libraries/navigation/Navigation.class.php
 @@ -189,9 +189,9 @@ public function getItemUnhideDialog($dbName, $itemType = null, $tableName = null
                          $html .= '<td style="width:80px"><a href="navigation.php?'
                              . PMA_URL_getCommon()
                              . '&unhideNavItem=true'
 -                            . '&itemType=' . $t
 -                            . '&itemName=' . urldecode($hiddenItem)
 -                            . '&dbName=' . urldecode($dbName) . '"'
 +                            . '&itemType=' . urlencode($t)
 +                            . '&itemName=' . urlencode($hiddenItem)
 +                            . '&dbName=' . urlencode($dbName) . '"'
                              . ' class="unhideNavItem ajax">'
                              . PMA_Util::getIcon('lightbulb.png', __('Show'))

libraries/navigation/Nodes/Node_DatabaseChild.class.php
 @@ -32,9 +32,9 @@ public function getHtmlForControlButtons()
                  . '<a href="navigation.php?'
                  . PMA_URL_getCommon()
                  . '&hideNavItem=true'
 -                . '&itemType=' . urldecode($this->getItemType())
 -                . '&itemName=' . urldecode($item)
 -                . '&dbName=' . urldecode($db) . '"'
 +                . '&itemType=' . urlencode($this->getItemType())
 +                . '&itemName=' . urlencode($item)
 +                . '&dbName=' . urlencode($db) . '"'
                  . ' class="hideNavItem ajax">'
                  . PMA_Util::getImage('lightbulb_off', __('Hide'))
                  . '</a></span>';