Pgadmin.org - vulnerabilities (CVEs)

41 CVEs in 1 products, 0 in the last 30 days, newest from 2026-09-17.

Products

Pgadmin 4 - 41 CVEs

Newest CVEs of Pgadmin.org

CVE-2026-86864 - CVSS 8.8 (high), 2026-09-17: pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pg_dump argument vector as a bare…
CVE-2026-86863 - CVSS 9.8 (critical), 2026-09-17: pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered…
CVE-2026-86862 - CVSS 7.1 (high), 2026-09-17: pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and…
CVE-2026-86861 - CVSS 6 (medium), 2026-09-17: pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with…
CVE-2026-17566 - CVSS 9.9 (critical), 2026-07-31: pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the…
CVE-2026-17351 - CVSS 9.4 (critical), 2026-07-31: The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as…
CVE-2026-17350 - CVSS 5.4 (medium), 2026-07-31: The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce its permission check consistently. In…
CVE-2026-17349 - CVSS 9.6 (critical), 2026-07-31: /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server…
CVE-2026-17348 - CVSS 6.9 (medium), 2026-07-31: In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles…
CVE-2026-17347 - CVSS 8.8 (high), 2026-07-31: The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key,…
CVE-2026-17346 - CVSS 8.8 (high), 2026-07-31: The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed…
CVE-2026-12049 - CVSS 6.1 (medium), 2026-06-18: Open redirect in pgAdmin 4's multi-factor authentication flow. The MFA validate and register endpoints honoured the user-supplied 'next' query/form parameter…
CVE-2026-12048 - CVSS 9.3 (critical), 2026-06-18: Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages,…
CVE-2026-12047 - CVSS 5.4 (medium), 2026-06-18: HTML injection in pgAdmin 4's cloud deployment module. The verify_credentials, deploy, regions, and update-server endpoints under /rds/, /azure/, /google/,…
CVE-2026-12046 - CVSS 9.5 (critical), 2026-06-18: Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST…
CVE-2026-12045 - CVSS 9.4 (critical), 2026-06-18: Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary…
CVE-2026-12050 - CVSS 8.8 (high), 2026-06-18: SQL injection in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-supplied 'value' field was interpolated…
CVE-2026-12044 - CVSS 8.8 (high), 2026-06-18: SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS '<description>'`` for a user-supplied description field. The Jinja…
CVE-2026-7820 - CVSS 6.9 (medium), 2026-05-11: Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4. pgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custom…
CVE-2026-7819 - CVSS 8.1 (high), 2026-05-11: Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager. check_access_permission used os.path.abspath, which resolves '..' but does not…
CVE-2026-7817 - CVSS 7.1 (high), 2026-05-11: Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints. User-supplied api_key_file and…
CVE-2026-7816 - CVSS 8.8 (high), 2026-05-11: OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export. User-supplied input was interpolated directly into a psql \copy…
CVE-2026-7818 - CVSS 7.8 (high), 2026-05-11: Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager. The session manager performed unsafe deserialization of session-file…
CVE-2026-7813 - CVSS 9.9 (critical), 2026-05-11: Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules. Multiple…
CVE-2026-7815 - CVSS 8.8 (high), 2026-05-11: SQL injection vulnerability in pgAdmin 4 Maintenance Tool. Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup,…
CVE-2026-7814 - CVSS 4.8 (medium), 2026-05-11: Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules. User-controlled PostgreSQL object names (database,…
CVE-2026-1707 - CVSS 7.4 (high), 2026-02-05: pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing…
CVE-2025-13780 - CVSS 9.1 (critical), 2025-12-11: pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from…
CVE-2025-12765 - CVSS 7.5 (high), 2025-11-13: pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.
CVE-2025-12762 - CVSS 9.8 (critical), 2025-11-13: pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from…