phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS)…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input from $_REQUEST parameters is reflected in HTML output without proper encoding or sanitization in multiple locations including sequences.php, indexes.php, admin.php, and other unspecified files. An attacker can exploit these vulnerabilities to execute arbitrary JavaScript in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious actions.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | phppgadmin/phppgadmin (Packagist) | up to 7.13.0 | — | No fix listed | GHSA-h369-cpjj-qfff |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- phppgadmin/phppgadmin (Packagist) Vendor— Affected up to 7.13.0 Fixed in — No fix listed GHSA-h369-cpjj-qfff
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:phppgadmin_project:phppgadmin:*:*:*:*:*:*:*:* | up to 7.13.0 | Vulnerable | Phppgadmin Project |
- cpe:2.3:a:phppgadmin_project:phppgadmin:*:*:*:*:*:*:*:* Versions up to 7.13.0 Vulnerable ·Phppgadmin Project
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-60796
- 2026-10-03 Alias added: GHSA-h369-cpjj-qfff
References
Advisory 2
More Phppgadmin Project Phppgadmin vulnerabilities
- TI-2023-21413 phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which… CVSS 3.1CRITICAL 9.8
- TI-2019-08049 Cross-site request forgery in phppgadmin CVSS 3.1CRITICAL 9.6
- TI-2025-37824 phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at… CVSS 3.1MEDIUM 6.5
- TI-2025-37823 phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at… CVSS 3.1MEDIUM 6.5
- TI-2025-37825 phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in… CVSS 3.1MEDIUM 6.1
- TI-2012-01391 Multiple cross-site scripting (XSS) vulnerabilities in functions.php in phpPgAdmin before… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2025-60796 · CVE Program
- CVE-2025-60796 · NVD
- FIRST EPSS
- GHSA-h369-cpjj-qfff · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences