EIP-2026-104396

PRE-CVE

phpPgAdmin 7.13.0 - COPY FROM PROGRAM Command Execution (Authenticated)

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-104396. PoCs published by Valerio Severini.

AI-analyzed exploit summary This is a technical writeup describing a remote command execution vulnerability in phpPgAdmin 7.13.0 via the COPY FROM PROGRAM SQL command. The attack involves creating a table, uploading a malicious .txt file with SQL commands, and executing it to achieve RCE.

Description

phpPgAdmin 7.13.0 - COPY FROM PROGRAM Command Execution (Authenticated)

Exploits (1)

exploitdb WRITEUP

by Valerio Severini · textwebappsmultiple

https://www.exploit-db.com/exploits/49736

View Code ZIP pw:eip

This is a technical writeup describing a remote command execution vulnerability in phpPgAdmin 7.13.0 via the COPY FROM PROGRAM SQL command. The attack involves creating a table, uploading a malicious .txt file with SQL commands, and executing it to achieve RCE.

Classification

Writeup 90%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: phpPgAdmin 7.13.0 or lower

Auth required

Prerequisites: Authenticated access to phpPgAdmin · Ability to create tables and upload files

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026