CVE-2023-40619: Phppgadmin Project Phppgadmin

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the 'ma[]' POST parameter is deserialized.

Affected products

• Phppgadmin Project Phppgadmin: up to and including 7.14.4

Published 2023-09-20. Last modified 2026-06-17.