logo

Database

Reflected cross-site scripting (XSS) In phppgadmin/phppgadmin

Description

phppgadmin vulnerable to Cross-site Scripting phpPgAdmin versions 7.13.0 and earlier contain multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied inputs from $_REQUEST parameters are reflected in HTML output without proper encoding or sanitization in multiple locations including sequences.php, indexes.php, admin.php, and other unspecified files. An attacker can exploit these vulnerabilities to execute arbitrary JavaScript in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious actions.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version

Aliases

1. CVE-2025-607962. NVD-2025-607963. OSV-2025-607964. OSV-DEBIAN-2025-607965. GCVE-2025-607966. SECURITY-TRACKER-CVE-2025-60796

References

1. https://github.com/phppgadmin/phppgadmin/blob/master/admin.php#L352. https://github.com/phppgadmin/phppgadmin/blob/master/indexes.php#L293. https://github.com/phppgadmin/phppgadmin/blob/master/sequences.php#L3164. https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60796.md

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.