PT-2025-47581 · Unknown · Phppgadmin

Published 2025-11-17 · Updated 2025-11-21 · CVE-2025-60796

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpPgAdmin versions prior to 7.13.0

Description The software contains multiple cross-site scripting (XSS) issues across various components. User-supplied input from $ REQUEST parameters is reflected in HTML output without proper encoding or sanitization. Specifically, the issue is present in files including sequences.php, indexes.php, and admin.php. An attacker can exploit these issues to execute arbitrary JavaScript in a victim’s browser, potentially leading to session hijacking or credential theft.

Recommendations Update to a version newer than 7.13.0.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-14877

CVE-2025-60796

GHSA-H369-CPJJ-QFFF

Affected Products

Phppgadmin

References · 17

• 🔥 https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60796.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-60796 · Security Note
• https://ubuntu.com/security/CVE-2025-60796 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-60796 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-60796 · Security Note
• https://osv.dev/vulnerability/CVE-2025-60796 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-60796 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14877 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-60796 · Vendor Advisory
• https://github.com/phppgadmin/phppgadmin/blob/master/sequences.php#L316 · Note
• https://github.com/phppgadmin/phppgadmin/blob/master/admin.php#L35 · Note
• https://github.com/phppgadmin/phppgadmin/blob/master/indexes.php#L29 · Note
• https://twitter.com/VulmonFeeds/status/1991558138575630412 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1p2foxr/resumen_diario_de_vulnerabilidades_20112025 · Reddit Post
• https://twitter.com/CVEnew/status/1991526233767854142 · Twitter Post