CVE catalog

CVE-2025-60797

DEBIAN-CVE-2025-60797

Severity: Unknown
Published: Nov 20, 2025, 3:17:38 PM UTC
Updated: Sep 1, 2026, 8:05:55 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.29% · Oct 25, 2026

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	phppgadmin	13	`7.14.7+dfsg-1`	vulnerable
Debian	phppgadmin	14	`7.14.7+dfsg-1`	vulnerable

Fixed-version evidence

OpenFactory catalog packages

[Debian 13 (Trixie)]

[phppgadmin]Affected
Details (2)
- 7.14.7+dfsg-1 · all · trixie
  Affected
  pypi · phppgadmin · debian · 13
- 7.14.7+dfsg-1 · all · trixie
  Affected
  pypi · phppgadmin · debian · 13

Observed: Oct 24, 2026, 8:33:58 AM UTC

References

[https://osv.dev/vulnerability/DEBIAN-CVE-2025-60797]

[FIRST EPSS] · [OSV Package Vulnerability Database]