phpMyAdmin -- multiple XSS vulnerabilities, missing validation

The phpMyAdmin development team reports:

Self-XSS due to unescaped HTML output in database structure page.

With a crafted table comment, it is possible to trigger an XSS in database structure page.

[source]

Self-XSS due to unescaped HTML output in database triggers page.

When navigating into the database triggers page, it is possible to trigger an XSS with a crafted trigger name.

[source]

Multiple XSS in AJAX confirmation messages.

With a crafted column name it is possible to trigger an XSS when dropping the column in table structure page. With a crafted table name it is possible to trigger an XSS when dropping or truncating the table in table operations page.

[source]

Access for an unprivileged user to MySQL user list.

An unpriviledged user could view the MySQL user list and manipulate the tabs displayed in phpMyAdmin for them.

[source]