CVE-2021-47853
High · 8.8phpPgAdmin contains a remote command execution vulnerability
CVSS
8.8
EPSS
—
Published
Jan 21, 2026
CISA due date
—
The record
phpPgAdmin 7.13.0 contains a remote command execution vulnerability that allows authenticated attackers to execute arbitrary system commands through SQL query manipulation. Attackers can create a custom table, upload a malicious .txt file, and use the COPY FROM PROGRAM command to execute operating system commands with the application's privileges.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | phppgadmin/phppgadmin | 0 | No fix |
Related vulnerabilities
- GHSA-86gh-c8r8-xwhq phpPgAdmin contains a remote command execution vulnerability Same vulnerability
- GHSA-g6xh-wrpf-v6j6 phppgadmin contains a SQL injection vulnerability Also affects phppgadmin/phppgadmin
- GHSA-r63p-v37q-g74c phppgadmin contains an incorrect access control vulnerability Also affects phppgadmin/phppgadmin
- GHSA-927w-vq5c-8gc3 phppgadmin contains a SQL injection vulnerability Also affects phppgadmin/phppgadmin
- GHSA-h369-cpjj-qfff phppgadmin vulnerable to Cross-site Scripting Also affects phppgadmin/phppgadmin
- CVE-2025-60796 phppgadmin vulnerable to Cross-site Scripting Also affects phppgadmin/phppgadmin
- CVE-2025-60799 phppgadmin contains an incorrect access control vulnerability Also affects phppgadmin/phppgadmin
- CVE-2025-60797 phppgadmin contains a SQL injection vulnerability Also affects phppgadmin/phppgadmin