CVE-2025-60796

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-60796", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-11-21T16:08:17.102Z", "dateReserved": "2025-09-26T00:00:00.000Z", "datePublished": "2025-11-20T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-11-20T14:56:39.625Z"}, "descriptions": [{"lang": "en", "value": "phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input from $_REQUEST parameters is reflected in HTML output without proper encoding or sanitization in multiple locations including sequences.php, indexes.php, admin.php, and other unspecified files. An attacker can exploit these vulnerabilities to execute arbitrary JavaScript in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious actions."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/phppgadmin/phppgadmin/blob/master/sequences.php#L316"}, {"url": "https://github.com/phppgadmin/phppgadmin/blob/master/indexes.php#L29"}, {"url": "https://github.com/phppgadmin/phppgadmin/blob/master/admin.php#L35"}, {"url": "https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60796.md"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-11-21T16:05:57.952516Z", "id": "CVE-2025-60796", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-21T16:08:17.102Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-60796", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-21T16:05:57.952516Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-21T16:06:22.959Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/phppgadmin/phppgadmin/blob/master/sequences.php#L316"}, {"url": "https://github.com/phppgadmin/phppgadmin/blob/master/indexes.php#L29"}, {"url": "https://github.com/phppgadmin/phppgadmin/blob/master/admin.php#L35"}, {"url": "https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60796.md"}], "descriptions": [{"lang": "en", "value": "phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input from $_REQUEST parameters is reflected in HTML output without proper encoding or sanitization in multiple locations including sequences.php, indexes.php, admin.php, and other unspecified files. An attacker can exploit these vulnerabilities to execute arbitrary JavaScript in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious actions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-11-20T14:56:39.625Z"}}}, "cveMetadata": {"cveId": "CVE-2025-60796", "state": "PUBLISHED", "dateUpdated": "2025-11-21T16:08:17.102Z", "dateReserved": "2025-09-26T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2025-11-20T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phppgadmin_project:phppgadmin:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC3CB38F-12CA-4FA6-98DB-FFCC98F26715", "versionEndIncluding": "7.13.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input from $_REQUEST parameters is reflected in HTML output without proper encoding or sanitization in multiple locations including sequences.php, indexes.php, admin.php, and other unspecified files. An attacker can exploit these vulnerabilities to execute arbitrary JavaScript in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious actions."}, {"lang": "es", "value": "phpPgAdmin 7.13.0 y versiones anteriores contiene m\u00faltiples vulnerabilidades de cross-site scripting (XSS) en varios componentes. La entrada proporcionada por el usuario de los par\u00e1metros $_REQUEST se refleja en la salida HTML sin la codificaci\u00f3n o sanitizaci\u00f3n adecuadas en m\u00faltiples ubicaciones, incluyendo sequences.php, indexes.php, admin.php y otros archivos no especificados. Un atacante puede explotar estas vulnerabilidades para ejecutar JavaScript arbitrario en los navegadores de las v\u00edctimas, lo que podr\u00eda llevar al secuestro de sesi\u00f3n, el robo de credenciales u otras acciones maliciosas."}], "id": "CVE-2025-60796", "lastModified": "2026-11-05T13:10:00.180", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-60796", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-21T16:05:57.952516Z", "version": "2.0.3"}}]}, "published": "2025-11-20T15:17:38.100", "references": [{"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/phppgadmin/phppgadmin/blob/master/admin.php#L35"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/phppgadmin/phppgadmin/blob/master/indexes.php#L29"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/phppgadmin/phppgadmin/blob/master/sequences.php#L316"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60796.md"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"created": "2025-11-24T09:10:38.492056+00:00", "updated": "2025-11-24T09:10:38.492080+00:00", "vendors": ["phppgadmin", "phppgadmin$PRODUCT$phppgadmin"]}