CVE-2023-40619 Deserialization in n/a
Remote attackers can execute arbitrary code by sending malicious serialized data to phpPgAdmin's table management features.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-40619?
CVE-2023-40619 is a critical unsafe deserialization vulnerability in n/a, published on 20 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the 'ma[]' POST parameter is deserialized.
Weakness: CWE-502
Which versions are affected by CVE-2023-40619?
It affects 1 product.
Products include Phppgadmin Project Phppgadmin.
How do I fix CVE-2023-40619?
Upgrade to a fixed version.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-40619 being exploited?
There is no known exploitation of CVE-2023-40619 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2019-10784 Cross-site request forgery in phppgadmin
- CVE-2025-60797 phppgadmin contains a SQL injection vulnerability
- CVE-2025-60798 phppgadmin contains a SQL injection vulnerability
- CVE-2025-60796 phppgadmin vulnerable to Cross-site Scripting
- CVE-2025-60799 phppgadmin contains an incorrect access control vulnerability
Sources
Also known as DEBIAN-CVE-2023-40619, DLA-3644-1, GHSA-r8pf-p598-jhpm, UBUNTU-CVE-2023-40619, openSUSE-SU-2024:13400-1.