Skip to content

Product

phppgadmin project phppgadmin vulnerabilities

7 published CVES affecting phppgadmin project phppgadmin, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
7
Critical
2
High
0
Medium
5
Low
0
Unscored
0
CISA KEV
0

Latest phppgadmin project phppgadmin CVEs

Newest publication first

  1. CVE-2025-60799 phppgadmin contains an incorrect access control vulnerability

    Published
    MediumCVSS 6.1 EPSS 0.22% PoC

    phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of session variables by accepting user-controlled parameters ('subject', 'server', 'database', 'queryid') without proper va...

  2. CVE-2025-60796 phppgadmin vulnerable to Cross-site Scripting

    Published
    MediumCVSS 6.1 EPSS 0.25% PoC

    phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input from $_REQUEST parameters is reflected in HTML output without proper encoding or sanitization in multiple locations including sequences.php, i...

  3. CVE-2025-60798 phppgadmin contains a SQL injection vulnerability

    Published
    MediumCVSS 6.5 EPSS 0.31% PoC

    phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulne...

  4. CVE-2025-60797 phppgadmin contains a SQL injection vulnerability

    Published
    MediumCVSS 6.5 EPSS 0.29% PoC

    phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['q...

  5. CVE-2023-40619 phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' func...

    Published
    CriticalCVSS 9.8 EPSS 1.3%

    phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'ta...

  6. CVE-2019-10784 phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, "database.php" does not verify the source of an H...

    Published
    CriticalCVSS 9.6 EPSS 3.6%

    phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, "database.php" does not verify the source of an HTTP request. This can be leveraged by a remote attacker to trick a logged-in adm...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.