phpPgAdmin versions 7.13.0 and earlier contain a SQL injection vulnerability in display.php at line 396. The vulnerability arises because user input from $_REQUEST['query'] is passed directly to the browseQuery function without proper sanitization. An authenticated attacker could exploit this to execute arbitrary SQL commands, potentially compromising the database. The vulnerability has a CVSS score of 6.5, indicating medium severity.