https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-60799.htmlhttps://patchthecve.com/cve/CVE-2025-60799.htmlWed, 17 Jun 2026 09:50:07 +0000MEDIUM 6.1: phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of session variables by accepting user-controlled parameters ('subject', 'server', 'database', 'queryid') without proper validation or access chttps://patchthecve.com/cve/CVE-2025-60798.htmlhttps://patchthecve.com/cve/CVE-2025-60798.htmlWed, 17 Jun 2026 09:50:07 +0000MEDIUM 6.5: phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute https://patchthecve.com/cve/CVE-2025-60797.htmlhttps://patchthecve.com/cve/CVE-2025-60797.htmlWed, 17 Jun 2026 09:50:07 +0000MEDIUM 6.5: phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authentihttps://patchthecve.com/cve/CVE-2025-60796.htmlhttps://patchthecve.com/cve/CVE-2025-60796.htmlWed, 17 Jun 2026 09:50:06 +0000MEDIUM 6.1: phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input from $_REQUEST parameters is reflected in HTML output without proper encoding or sanitization in multiple locations including sequences.php, indexes.php, admin.ph