xzilla

2 exploits Active since Nov 2025
CVE-2025-60797 WRITEUP MEDIUM WRITEUP
phppgadmin < 7.13.0 - Authenticated SQL Injection via dataexport.php Query Parameter
phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation.
CVSS 6.5
CVE-2025-60799 WRITEUP MEDIUM WRITEUP
phpPgAdmin <7.13.0 - Code Injection
phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of session variables by accepting user-controlled parameters ('subject', 'server', 'database', 'queryid') without proper validation or access control checks. Attackers can exploit this to store arbitrary SQL queries in $_SESSION['sqlquery'] by manipulating these parameters, potentially leading to session poisoning, stored cross-site scripting, or unauthorized access to sensitive session data.
CVSS 6.1