CVE-2025-63947

MediumCVSS 5.4

Published: 18/12/2025(UTC)Updated: 13/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

6th percentile - higher than 6% of all known CVEs

Summary

Reflected XSS vulnerability in phpMsAdmin version 2.2 in database_mode.php. An attacker can execute arbitrary web script or HTML via the dbname parameter after authentication.

Risk Assessment

A logged-in user can be tricked into clicking a malicious link, potentially leading to script execution in the session context and data theft.

Recommendation

Update phpMsAdmin to the latest version and apply output encoding and validation for the dbname parameter.

Other vulnerabilities in phpMsAdmin

CVE-2025-63948Medium
A SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute arbitrary SQL commands via the dbname parameter, potentially leading to information disclosure or database manipulation.

Original NVD description (English source)

A Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute arbitrary web script or HTML via the dbname parameter after a user is authenticated.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS