phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input from $_REQUEST parameters is reflected in HTML output without proper encoding or sanitization in multiple locations including sequences.php, indexes.php, admin.php, and other unspecified files. An attacker can exploit these vulnerabilities to execute arbitrary JavaScript in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious actions.
References
Configurations
History
25 Nov 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Phppgadmin Project phppgadmin
Phppgadmin Project |
|
| CPE | cpe:2.3:a:phppgadmin_project:phppgadmin:*:*:*:*:*:*:*:* | |
| References | () https://github.com/phppgadmin/phppgadmin/blob/master/admin.php#L35 - Product | |
| References | () https://github.com/phppgadmin/phppgadmin/blob/master/indexes.php#L29 - Product | |
| References | () https://github.com/phppgadmin/phppgadmin/blob/master/sequences.php#L316 - Product | |
| References | () https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60796.md - Third Party Advisory |
21 Nov 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| CWE | CWE-79 |
20 Nov 2025, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-20 15:17
Updated : 2025-11-25 19:15
NVD link : CVE-2025-60796
Mitre link : CVE-2025-60796
CVE.ORG link : CVE-2025-60796
JSON object : View
Products Affected
phppgadmin_project
- phppgadmin
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')