CVE catalog

CVE-2025-60798

DEBIAN-CVE-2025-60798

Severity: Unknown
Published: Nov 20, 2025, 3:17:38 PM UTC
Updated: Sep 1, 2026, 8:05:55 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.31% · Oct 25, 2026

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	phppgadmin	13	`7.14.7+dfsg-1`	vulnerable
Debian	phppgadmin	14	`7.14.7+dfsg-1`	vulnerable

Fixed-version evidence

OpenFactory catalog packages

[Debian 13 (Trixie)]

[phppgadmin]Affected
Details (2)
- 7.14.7+dfsg-1 · all · trixie
  Affected
  pypi · phppgadmin · debian · 13
- 7.14.7+dfsg-1 · all · trixie
  Affected
  pypi · phppgadmin · debian · 13

Observed: Oct 24, 2026, 8:33:58 AM UTC

References

[https://osv.dev/vulnerability/DEBIAN-CVE-2025-60798]

[FIRST EPSS] · [OSV Package Vulnerability Database]