Threats affecting pkg:github/solonbarroso/phpMsAdmin

CVE-2025-63948 is a medium-severity SQL Injection vulnerability in phpMsAdmin version 2.2, specifically in the database_mode.php file. It allows an attacker with low privileges to execute arbitrary SQL commands via the dbname parameter without user interaction. This can lead to limited information disclosure and database manipulation but does not affect availability. No known exploits are currently reported in the wild. The vulnerability requires network access and some level of privilege but no user interaction. European organizations using phpMsAdmin 2.2 should prioritize patching or mitigating this issue to prevent potential data breaches or unauthorized database changes.

A Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute arbitrary web script or HTML via the dbname parameter after a user is authenticated.