CVE-2023-40619

The CVE-2023-40619 issue affects phpPgAdmin 7.14.4 and earlier, where untrusted data is deserialized (e.g., the ma[] POST parameter in tables.php) via PHP unserialize(), enabling remote code execution. Confirmed impact is remote code execution with high severity (CVSS 3.1: CRITICAL). Remediation ...

CVE-2019-10784

CVE-2019-10784 affects phpPgAdmin up to version 7.12.1. The issue is an improper source validation in the application, notably in database.php, enabling CSRF abuse that could let a remote attacker trick an authenticated administrator into visiting a malicious page and execute arbitrary system com...

CVE-2012-1600

Multiple cross-site scripting (XSS) vulnerabilities affect phpPgAdmin in the PHP file functions.php, exploitable before version 5.0.4 via the (1) name or (2) type of a function. The issue allows remote attackers to inject arbitrary web script or HTML. Affected product: phpPgAdmin; vulnerable comp...

CVE-2025-60796

The phpPgAdmin web administration tool (versions 7.13.0 and earlier ) is vulnerable to multiple cross-site scripting (XSS) flaws. The root cause is the improper sanitization and encoding of user-supplied input from 😏_REQUEST parameters, which are reflected in the HTML output across various compon...

CVE-2025-60799

The web-based administration tool phpPgAdmin versions 7.13.0 and earlier is vulnerable to an incorrect access control flaw in the sql.php file (specifically lines 68-76). The application fails to properly validate or check access controls for user-controlled parameters, including subject, server,...

CVE-2025-60797

The phpPgAdmin web-based administration tool for PostgreSQL (versions 7.13.0 and earlier ) is vulnerable to a SQL injection in the dataexport.php file at line 118. The root cause is the direct execution of user-supplied input from the $_REQUEST['query'] parameter via $data->conn->Execute($_...

CVE-2025-60798

The web-based administration tool phpPgAdmin versions 7.13.0 and earlier is vulnerable to a SQL injection in the display.php script (line 396). The root cause is the lack of proper sanitization when user-controlled input from the $_REQUEST['query'] parameter is passed directly to the browseQuery ...