Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-60797

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation.

Published

2025-11-20T15:17:38.250

Last Modified

2025-11-25T19:13:30.203

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-89
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application phppgadmin_project phppgadmin ≤ 7.13.0 Yes
References