Log in Start free

Vulnerability · Published Nov 20, 2025 · Assigned by mitre

CVE-2025-60796

Medium 6.1

In plain English

A medium-severity cross-site scripting in the phppgadmin package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.2%top 83.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input from $_REQUEST parameters is reflected in HTML output without proper encoding or sanitization in multiple locations including sequences.php, indexes.php, admin.php, and other unspecified files. An attacker can exploit these vulnerabilities to execute arbitrary JavaScript in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious actions.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13phppgadminno fix listedDEBIAN-CVE-2025-60796
Debian:14phppgadminno fix listedDEBIAN-CVE-2025-60796
Packagistphppgadmin/phppgadminno fix listedGHSA-h369-cpjj-qfff
Ubuntu:22.04:LTSphppgadminno fix listedUBUNTU-CVE-2025-60796
Ubuntu:24.04:LTSphppgadminno fix listedUBUNTU-CVE-2025-60796
Ubuntu:25.10phppgadminno fix listedUBUNTU-CVE-2025-60796
Ubuntu:26.04:LTSphppgadminno fix listedUBUNTU-CVE-2025-60796
Ubuntu:26.10phppgadminno fix listedUBUNTU-CVE-2025-60796

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References