phpPgAdmin versions 7.13.0 and earlier contain a SQL injection vulnerability in the dataexport.php file. The vulnerability arises because user-supplied SQL queries from the $_REQUEST['query'] parameter are executed directly without sanitization or parameterization. An authenticated attacker could exploit this flaw to execute arbitrary SQL commands, risking database compromise, data theft, or privilege escalation.