Every CVE Search/ Get API key

CVE-2025-60798

phppgadmin contains a SQL injection vulnerability

6.5 Medium

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.31%Up 0.3 points since Nov 21, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.5

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.

Record
CVE-2025-60798
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-89
Updated
2026-11-02
EUVDEUVD-2025-198265 6.5

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.

Record
EUVD-2025-198265
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-g6xh-wrpf-v6j6 6.5

phppgadmin contains a SQL injection vulnerability

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.

Record
GHSA-g6xh-wrpf-v6j6
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-89
Updated
2026-11-02
NVD 6.5

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.

Record
CVE-2025-60798
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-89
Updated
2026-11-05
OSV 6.5

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.

Record
CVE-2025-60798
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-07
OSVDEBIAN-CVE-2025-60798 6.5

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.

Record
DEBIAN-CVE-2025-60798
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-06
OSVGHSA-g6xh-wrpf-v6j6 6.5

phppgadmin contains a SQL injection vulnerability

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.

Record
GHSA-g6xh-wrpf-v6j6
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-89
Updated
2026-11-02
OSVUBUNTU-CVE-2025-60798 6.5

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.

Record
UBUNTU-CVE-2025-60798
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
phppgadmin/phppgadmin
Packagist
 through 7.13.0 None known
phppgadmin
Debian:13
 All versions, plus listed versions
7.14.7+dfsg-17.14.8+dfsg-1
 None known
phppgadmin
Debian:14
 All versions, plus listed versions
7.14.7+dfsg-17.14.8+dfsg-1
 None known
phppgadmin
Ubuntu:16.04:LTS
 All versions, plus listed versions
5.1+ds-15.1+ds-1ubuntu1
 None known
phppgadmin
Ubuntu:18.04:LTS
 All versions, plus listed versions
5.1+ds-25.1+ds-3
 None known
phppgadmin
Ubuntu:20.04:LTS
 All versions, plus listed versions
5.1+ds-47.12.0+ds-27.12.0+ds-37.12.1+dfsg-1
 None known
phppgadmin
Ubuntu:22.04:LTS
 All versions, plus listed versions
7.13.0+dfsg-2
 None known
phppgadmin
Ubuntu:24.04:LTS
 All versions, plus listed versions
7.13.0+dfsg-27.13.0+dfsg-37.14.7+dfsg-1
 None known
phppgadmin
Ubuntu:25.10
 All versions, plus listed versions
7.14.7+dfsg-1
 None known
phppgadmin
Ubuntu:26.10
 All versions, plus listed versions
7.14.7+dfsg-1build17.14.8+dfsg-1
 None known
phppgadmin
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.14.7+dfsg-17.14.7+dfsg-1build1
 None known

History

History
RecordedChangedSources
affectedOSV
factsNVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-60798 is a medium vulnerability (CVSS 6.5) in Phppgadmin Project Phppgadmin, published November 20, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. No source names a fixed version.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open