PT-2026-6394 · Packagist · Phppgadmin/Phppgadmin

Publicado 2026-01-21 · Atualizado 2026-01-21

OSV

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

phpPgAdmin 7.13.0 contains a remote command execution vulnerability that allows authenticated attackers to execute arbitrary system commands through SQL query manipulation. Attackers can create a custom table, upload a malicious .txt file, and use the COPY FROM PROGRAM command to execute operating system commands with the application's privileges.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

GHSA-86GH-C8R8-XWHQ

Produtos afetados

Phppgadmin/Phppgadmin

Referências · 6

• https://github.com/phppgadmin/phppgadmin/releases · Nota
• https://github.com/phppgadmin/phppgadmin · Nota
• https://osv.dev/vulnerability/GHSA-86gh-c8r8-xwhq · Aviso do Fabricante
• https://vulncheck.com/advisories/phppgadmin-copy-from-program-command-execution · Nota
• https://exploit-db.com/exploits/49736 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2021-47853 · Nota de Segurança