VULNERABILITY INTELLIGENCE

CVE-2025-60798

CVSS score6.5 MEDIUM

EPSS probability0.31%

CISA KEVNot currently listed

Published2025-11-20

Last modified2026-06-17

Description

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.