CVE-2025-60797
Medium · 6.5phppgadmin contains a SQL injection vulnerability
CVSS
6.5
EPSS
0.3%
Published
Nov 20, 2025
CISA due date
—
The record
phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | phppgadmin/phppgadmin | 0 | No fix |
Related vulnerabilities
- GHSA-927w-vq5c-8gc3 phppgadmin contains a SQL injection vulnerability Same vulnerability
- GHSA-86gh-c8r8-xwhq phpPgAdmin contains a remote command execution vulnerability Also affects phppgadmin/phppgadmin
- CVE-2021-47853 phpPgAdmin contains a remote command execution vulnerability Also affects phppgadmin/phppgadmin
- GHSA-g6xh-wrpf-v6j6 phppgadmin contains a SQL injection vulnerability Also affects phppgadmin/phppgadmin
- GHSA-r63p-v37q-g74c phppgadmin contains an incorrect access control vulnerability Also affects phppgadmin/phppgadmin
- GHSA-h369-cpjj-qfff phppgadmin vulnerable to Cross-site Scripting Also affects phppgadmin/phppgadmin
- CVE-2025-60796 phppgadmin vulnerable to Cross-site Scripting Also affects phppgadmin/phppgadmin
- CVE-2025-60799 phppgadmin contains an incorrect access control vulnerability Also affects phppgadmin/phppgadmin