CVE-2025-60798 — SQL Injection in Project Phppgadmin

CWE-89 — SQL Injection5 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.0%
top 93.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Phppgadmin Project PhppgadminPhppgadminDebian Phppgadmin
Timeline
PublishedNov 20

Description

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶Packagistphppgadmin/phppgadmin7.13.0

🔴Vulnerability Details

3
GHSA
phppgadmin contains a SQL injection vulnerability↗2025-11-20
▶
OSV
phppgadmin contains a SQL injection vulnerability↗2025-11-20
▶
OSV
CVE-2025-60798: phpPgAdmin 7↗2025-11-20
▶

📋Vendor Advisories

1
Debian
CVE-2025-60798: phppgadmin - phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display....↗2025
▶