Description
Cross-site scripting (XSS) vulnerability in phpPgAdmin 3.5 to 4.1.1, and possibly 4.1.2, allows remote attackers to inject arbitrary web script or HTML via certain input available in PHP_SELF in (1) redirect.php, possibly related to (2) login.php, different vectors than CVE-2007-2865.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | phppgadmin | 4.1.3-0.1 | — |
| Debian 13 | phppgadmin | 4.1.3-0.1 | — |
| Debian 4.0 | phppgadmin | 4.0.1-3.1etch1 | DSA-1693-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- phpPgAdmin 4.1.1 - 'Redirect.php' Cross-Site Scripting EDB-30090 · webapps · May 25, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- phpPgAdmin <=4.1.1 - Cross-Site Scripting http/cves/2007/CVE-2007-5728.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- DSA-1693-1 phppgadmin - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 27756 third-party-advisory
- 36699 vdb-entry
- 20070527 phpPgAdmin Multiple XSS Vulnerabilities mailing-list
- 25446 third-party-advisory
- 24182 vdb-entry
- SUSE-SR:2007:024 vendor-advisory
- 33263 third-party-advisory
- phppgadmin-redirect-xss(34550) vdb-entry
- DSA-1693 vendor-advisory