{"id":"GHSA-g6xh-wrpf-v6j6","aliases":["CVE-2025-60798"],"title":"phppgadmin contains a SQL injection vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.","severity":"medium","score":6.5,"published":"2025-11-20T15:30:24.000Z","modified":"2025-11-21T19:15:52.000Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"phppgadmin/phppgadmin","sources":[{"name":"OSV · GHSA-g6xh-wrpf-v6j6","url":"https://osv.dev/vulnerability/GHSA-g6xh-wrpf-v6j6"}],"ranges":[{"events":[{"introduced":"0"},{"last_affected":"7.13.0"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":[]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-60798","https://github.com/phppgadmin/phppgadmin","https://github.com/phppgadmin/phppgadmin/blob/master/display.php#L396","https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60797.md","https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60798.md"],"sources":[{"name":"OSV","id":"GHSA-g6xh-wrpf-v6j6","modified":"2025-11-21T19:15:52Z","url":"https://osv.dev/vulnerability/GHSA-g6xh-wrpf-v6j6"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T23:25:34.350Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}