Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

pgadmin4

28 known vulnerabilities (7 critical, 13 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release
9.19.0 (Oct 29, 2026): no advisory affects it
Newest unaffected release
9.19.0 (Oct 29, 2026), the latest release
Advisories
28 · 7 critical, 13 high, 6 medium
Weekly downloads
4,614
Dependents
1
Releases
81 since 4.22.0 (May 28, 2020)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 28 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 28

  • CVE-2026-7820Medium 6.5

    pgAdmin 4: Account-lockout bypass via Flask-Security default /login view

    Affected: fixed in 9.15.

    Fixed in 9.15.0 (released May 11, 2026, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write

    Affected: fixed in 9.15.

    Fixed in 9.15.0 (released May 11, 2026, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution

    Affected: fixed in 9.15.

    Fixed in 9.15.0 (released May 11, 2026, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • CVE-2026-7817Medium 6.5

    pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpoints

    Affected: fixed in 9.15.

    Fixed in 9.15.0 (released May 11, 2026, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout

    Affected: fixed in 9.15.

    Fixed in 9.15.0 (released May 11, 2026, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution

    Affected: fixed in 9.15.

    Fixed in 9.15.0 (released May 11, 2026, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • CVE-2026-7814Medium 4.8

    pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer

    Affected: fixed in 9.15.

    Fixed in 9.15.0 (released May 11, 2026, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • CVE-2026-7813Critical 9.9

    pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode

    Affected: fixed in 9.15.

    Fixed in 9.15.0 (released May 11, 2026, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • Restore restriction bypass via key disclosure vulnerability (pgAdmin 4)

    Affected: fixed in 9.12.

    Fixed in 9.12.0 (released Feb 5, 2026, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • CVE-2025-13780Critical 9.1

    Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

    Affected: fixed in 9.11.

    Fixed in 9.11.0 (released Dec 11, 2025, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass.

    Affected: fixed in 9.10.

    Fixed in 9.10.0 (released Nov 13, 2025, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.

    Affected: fixed in 9.10.

    Fixed in 9.10.0 (released Nov 13, 2025, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • CVE-2025-12763Medium 6.8

    Command injection vulnerability allowing arbitrary command execution on Windows

    Affected: fixed in 9.10.

    Fixed in 9.10.0 (released Nov 13, 2025, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • CVE-2025-12762Critical 9.1

    Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

    Affected: fixed in 9.10.

    Fixed in 9.10.0 (released Nov 13, 2025, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • Cross-Origin Opener Policy Vulnerability in pgAdmin 4

    Affected: fixed in 9.8.

    Fixed in 9.8.0 (released Sep 4, 2025, the day of disclosure).

    The latest release, 9.19.0, is not affected.

Show all 28 advisoriesShow fewer advisories
  • CVE-2025-2946Critical 9.1

    Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data…

    Affected: fixed in 9.2.

    Fixed in 9.2.0 (released Apr 3, 2025, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • CVE-2025-2945Critical 9.9

    pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment

    Affected: fixed in 9.2.

    Fixed in 9.2.0 (released Apr 3, 2025, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong session

    Affected: fixed in 7.0.

    Fixed in 7.0.0 (released Apr 13, 2023, 637 days before disclosure).

    The latest release, 9.19.0, is not affected.

  • CVE-2024-9014Critical 9.9

    OAuth2 client id and secret exposed through the web browser in pgAdmin 4

    Affected: fixed in 8.12.

    Fixed in 8.12.0 (released Sep 23, 2024, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • XSS vulnerability in /settings/store API response json payload in pgAdmin 4

    Affected: fixed in 8.6.

    Fixed in 8.6.0 (released May 2, 2024, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • The Multi Factor Authentication bypass vulnerability in pgAdmin 4

    Affected: fixed in 8.6.

    Fixed in 8.6.0 (released May 2, 2024, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4

    Affected: fixed in 8.5.

    Fixed in 8.5.0 (released Apr 4, 2024, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • CVE-2024-2044Critical 9.9

    Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4

    Affected: fixed in 8.4.

    Fixed in 8.4.0 (released Mar 7, 2024, the day of disclosure).

    The latest release, 9.19.0, is not affected.

  • CVE-2023-5002Medium 6.0

    Pgadmin4: remote code execution by an authenticated user

    Affected: fixed in 7.7.

    Fixed in 7.7.0 (released Sep 21, 2023, 1 day before disclosure).

    The latest release, 9.19.0, is not affected.

  • pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability.

    Affected: fixed in 6.19.

    Fixed in 6.19.0 (released Jan 17, 2023, 69 days before disclosure).

    The latest release, 9.19.0, is not affected.

  • CVE-2023-22298Medium 6.1

    Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an…

    Affected: fixed in 6.14.

    Fixed in 6.14.0 (released Sep 22, 2022, 117 days before disclosure).

    The latest release, 9.19.0, is not affected.

  • The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities…

    Affected: fixed in 6.17.

    Fixed in 6.17.0 (released Dec 2, 2022, 11 days before disclosure).

    The latest release, 9.19.0, is not affected.

  • A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to…

    Affected: fixed in 6.7.

    Fixed in 6.7.0 (released Mar 14, 2022, 2 days before disclosure).

    The latest release, 9.19.0, is not affected.