Every CVE Search/ Get API key

CVE-2023-40619

phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead...

9.8 CriticalFix available

phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the 'ma[]' POST parameter is deserialized.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.32%Up 1.2 points since Sep 22, 2023
90%50%10%1%

What each source reports

NVD Score used 9.8

phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the 'ma[]' POST parameter is deserialized.

Record
CVE-2023-40619
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
CVE List No score

phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the 'ma[]' POST parameter is deserialized.

Record
CVE-2023-40619
Updated
2026-11-02
EUVDEUVD-2023-45175 No score

phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the 'ma[]' POST parameter is deserialized.

Record
EUVD-2023-45175
Updated
2026-11-03
GitHub AdvisoriesGHSA-r8pf-p598-jhpm 9.8

phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead...

phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the 'ma[]' POST parameter is deserialized.

Record
GHSA-r8pf-p598-jhpm
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSV 9.8

phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the 'ma[]' POST parameter is deserialized.

Record
CVE-2023-40619
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-40619 9.8

phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the 'ma[]' POST parameter is deserialized.

Record
DEBIAN-CVE-2023-40619
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-40619 9.8

phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the 'ma[]' POST parameter is deserialized.

Record
UBUNTU-CVE-2023-40619
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:13400-1 No score

phpPgAdmin-7.14.6-1.1 on GA media

These are all security issues fixed in the phpPgAdmin-7.14.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13400-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
phppgadmin
Debian:13
 before 7.14.7+dfsg-1
7.14.7+dfsg-1
phppgadmin
Debian:14
 before 7.14.7+dfsg-1
7.14.7+dfsg-1
phppgadmin
Debian:10
 before 5.1+ds-4+deb10u1, plus listed versions
5.1+ds-4
5.1+ds-4+deb10u1
phppgadmin
Ubuntu:16.04:LTS
 All versions, plus listed versions
5.1+ds-15.1+ds-1ubuntu1
 None known
phppgadmin
Ubuntu:18.04:LTS
 All versions, plus listed versions
5.1+ds-25.1+ds-3
 None known
phppgadmin
Ubuntu:20.04:LTS
 All versions, plus listed versions
5.1+ds-47.12.0+ds-27.12.0+ds-37.12.1+dfsg-1
 None known
phppgadmin
Ubuntu:22.04:LTS
 All versions, plus listed versions
7.13.0+dfsg-2
 None known
phppgadmin
Ubuntu:24.04:LTS
 All versions, plus listed versions
7.13.0+dfsg-27.13.0+dfsg-37.14.7+dfsg-1
 None known
phppgadmin
Ubuntu:25.10
 All versions, plus listed versions
7.14.7+dfsg-1
 None known
phppgadmin
Ubuntu:26.10
 All versions, plus listed versions
7.14.7+dfsg-1build17.14.8+dfsg-1
 None known
phppgadmin
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.14.7+dfsg-17.14.7+dfsg-1build1
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-40619 is a critical vulnerability (CVSS 9.8) in Phppgadmin Project Phppgadmin, published September 20, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.32%, the 71st percentile. Fixed in phppgadmin 7.14.7+dfsg-1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open