CVE catalog

CVE-2025-60796

DEBIAN-CVE-2025-60796

Severity: Unknown
Published: Nov 20, 2025, 3:17:38 PM UTC
Updated: Sep 1, 2026, 8:05:55 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.25% · Oct 25, 2026

phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input from $_REQUEST parameters is reflected in HTML output without proper encoding or sanitization in multiple locations including sequences.php, indexes.php, admin.php, and other unspecified files. An attacker can exploit these vulnerabilities to execute arbitrary JavaScript in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious actions.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	phppgadmin	13	`7.14.7+dfsg-1`	vulnerable
Debian	phppgadmin	14	`7.14.7+dfsg-1`	vulnerable

Fixed-version evidence

OpenFactory catalog packages

[Debian 13 (Trixie)]

[phppgadmin]Affected
Details (2)
- 7.14.7+dfsg-1 · all · trixie
  Affected
  pypi · phppgadmin · debian · 13
- 7.14.7+dfsg-1 · all · trixie
  Affected
  pypi · phppgadmin · debian · 13

Observed: Oct 24, 2026, 8:33:58 AM UTC

References

[https://osv.dev/vulnerability/DEBIAN-CVE-2025-60796]

[FIRST EPSS] · [OSV Package Vulnerability Database]