CVE-2025-60799

published 2025-11-20

CVE-2025-60799: phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of…

Priority P4 31 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of session variables by accepting user-controlled parameters ('subject', 'server', 'database', 'queryid') without proper validation or access control checks. Attackers can exploit this to store arbitrary SQL queries in $_SESSION['sqlquery'] by manipulating these parameters, potentially leading to session poisoning, stored cross-site scripting, or unauthorized access to sensitive session data.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
debian	phppgadmin	—	—
phppgadmin	phppgadmin	0 – 7.13.0	—
phppgadmin_project	phppgadmin	<= 7.13.0	—

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

osv 6.1 MEDIUM

vendor_debian 6.1 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-284