CVE catalog

CVE-2025-60799

DEBIAN-CVE-2025-60799

Severity: Unknown
Published: Nov 20, 2025, 3:17:38 PM UTC
Updated: Sep 1, 2026, 8:05:54 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.22% · Oct 25, 2026

phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of session variables by accepting user-controlled parameters ('subject', 'server', 'database', 'queryid') without proper validation or access control checks. Attackers can exploit this to store arbitrary SQL queries in $_SESSION['sqlquery'] by manipulating these parameters, potentially leading to session poisoning, stored cross-site scripting, or unauthorized access to sensitive session data.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	phppgadmin	13	`7.14.7+dfsg-1`	vulnerable
Debian	phppgadmin	14	`7.14.7+dfsg-1`	vulnerable

Fixed-version evidence

OpenFactory catalog packages

[Debian 13 (Trixie)]

[phppgadmin]Affected
Details (2)
- 7.14.7+dfsg-1 · all · trixie
  Affected
  pypi · phppgadmin · debian · 13
- 7.14.7+dfsg-1 · all · trixie
  Affected
  pypi · phppgadmin · debian · 13

Observed: Oct 24, 2026, 8:33:58 AM UTC

References

[https://osv.dev/vulnerability/DEBIAN-CVE-2025-60799]

[FIRST EPSS] · [OSV Package Vulnerability Database]