SQL Injection in Phppgadmin Project
CVE-2025-60798
phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.003 (19.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 19th percentile — 19.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
Weakness classification (CWE)
References
- github.com/phppgadmin/phppgadmin/blob/master/display.php (Product)
- github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60797.md (Not Applicable)
- github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60798.md (Third Party Advisory)
Frequently asked questions
- What is CVE-2025-60798?
- CVE-2025-60798 is a medium-severity vulnerability in Phppgadmin Project, classified under SQL Injection. CVSS score: 6.5/10. Published 2025-11-20.
- How severe is CVE-2025-60798?
- Medium severity. CVSS v3 base score is 6.5 out of 10.