PatchTheCVEphpmsadmin vulnerabilities and fixes
Recent CVEs affecting phpmsadmin, with upgrade or downgrade steps. 2 tracked.
phpmsadmin has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-12-18. Highest priority: CVE-2025-63948 (score 27/100).
- CVE-2025-63948 MEDIUM 5.4 DOWNGRADE A SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file
- CVE-2025-63947 MEDIUM 5.4 DOWNGRADE A Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php
FAQ
How do I fix phpmsadmin vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is phpmsadmin being exploited right now?
None of the tracked phpmsadmin CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which phpmsadmin CVE should I patch first?
CVE-2025-63948 currently ranks highest (27/100): A SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file.