# pgadmin4 (PyPI) vulnerabilities 28 known vulnerabilities (7 critical, 13 high, 6 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 9.19.0 (Oct 29, 2026): no advisory affects it - Newest unaffected release: 9.19.0 (Oct 29, 2026), the latest release - Weekly downloads: 4,614 - Dependents: 1 - Releases: 81 since 4.22.0 (May 28, 2020) - Registry: https://pypi.org/project/pgadmin4/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-7820: 4.22.0 to 9.14.0 (9.15.0 is outside it) - CVE-2026-7819: 4.22.0 to 9.14.0 (9.15.0 is outside it) - CVE-2026-7818: 4.22.0 to 9.14.0 (9.15.0 is outside it) - CVE-2026-7817: 4.22.0 to 9.14.0 (9.15.0 is outside it) - CVE-2026-7816: 4.22.0 to 9.14.0 (9.15.0 is outside it) - CVE-2026-7815: 4.22.0 to 9.14.0 (9.15.0 is outside it) - CVE-2026-7814: 4.22.0 to 9.14.0 (9.15.0 is outside it) - CVE-2026-7813: 4.22.0 to 9.14.0 (9.15.0 is outside it) - CVE-2026-1707: 4.22.0 to 9.11.0 (9.12.0 is outside it) - CVE-2025-13780: 4.22.0 to 9.10.0 (9.11.0 is outside it) - CVE-2025-12765: 4.22.0 to 9.9.0 (9.10.0 is outside it) - CVE-2025-12764: 4.22.0 to 9.9.0 (9.10.0 is outside it) - CVE-2025-12763: 4.22.0 to 9.9.0 (9.10.0 is outside it) - CVE-2025-12762: 4.22.0 to 9.9.0 (9.10.0 is outside it) - CVE-2025-9636: 4.22.0 to 9.7.0 (9.8.0 is outside it) - CVE-2025-2946: 4.22.0 to 9.1.0 (9.2.0 is outside it) - CVE-2025-2945: 4.22.0 to 9.1.0 (9.2.0 is outside it) - CVE-2023-1907: 4.22.0 to 6.21.0 (7.0.0 is outside it) - CVE-2024-9014: 4.22.0 to 8.11.0 (8.12.0 is outside it) - CVE-2024-4216: 4.22.0 to 8.5.0 (8.6.0 is outside it) - CVE-2024-4215: 4.22.0 to 8.5.0 (8.6.0 is outside it) - CVE-2024-3116: 4.22.0 to 8.4.0 (8.5.0 is outside it) - CVE-2024-2044: 4.22.0 to 8.3.0 (8.4.0 is outside it) - CVE-2023-5002: 4.22.0 to 7.6.0 (7.7.0 is outside it) - CVE-2023-0241: 4.22.0 to 6.18.0 (6.19.0 is outside it) - CVE-2023-22298: 4.22.0 to 6.13.0 (6.14.0 is outside it) - CVE-2022-4223: 4.22.0 to 6.16.0 (6.17.0 is outside it) - CVE-2022-0959: 4.22.0 to 6.6.0 (6.7.0 is outside it) ## Advisories (28) ### [CVE-2026-7820](https://cve.now/CVE-2026-7820): pgAdmin 4: Account-lockout bypass via Flask-Security default /login view - Severity: Medium 6.5 - Published: May 11, 2026 - Affected: fixed in 9.15. - Fixed in 9.15.0 (released May 11, 2026, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2026-7819](https://cve.now/CVE-2026-7819): pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write - Severity: High 8.1 - Published: May 11, 2026 - Affected: fixed in 9.15. - Fixed in 9.15.0 (released May 11, 2026, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2026-7818](https://cve.now/CVE-2026-7818): pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution - Severity: High 7.0 - Published: May 11, 2026 - Affected: fixed in 9.15. - Fixed in 9.15.0 (released May 11, 2026, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2026-7817](https://cve.now/CVE-2026-7817): pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpoints - Severity: Medium 6.5 - Published: May 11, 2026 - Affected: fixed in 9.15. - Fixed in 9.15.0 (released May 11, 2026, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2026-7816](https://cve.now/CVE-2026-7816): pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout - Severity: High 8.8 - Published: May 11, 2026 - Affected: fixed in 9.15. - Fixed in 9.15.0 (released May 11, 2026, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2026-7815](https://cve.now/CVE-2026-7815): pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution - Severity: High 8.8 - Published: May 11, 2026 - Affected: fixed in 9.15. - Fixed in 9.15.0 (released May 11, 2026, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2026-7814](https://cve.now/CVE-2026-7814): pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer - Severity: Medium 4.8 - Published: May 11, 2026 - Affected: fixed in 9.15. - Fixed in 9.15.0 (released May 11, 2026, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2026-7813](https://cve.now/CVE-2026-7813): pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode - Severity: Critical 9.9 - Published: May 11, 2026 - Affected: fixed in 9.15. - Fixed in 9.15.0 (released May 11, 2026, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2026-1707](https://cve.now/CVE-2026-1707): Restore restriction bypass via key disclosure vulnerability (pgAdmin 4) - Severity: High 7.4 - Published: Feb 5, 2026 - Affected: fixed in 9.12. - Fixed in 9.12.0 (released Feb 5, 2026, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2025-13780](https://cve.now/CVE-2025-13780): Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4) - Severity: Critical 9.1 - Published: Dec 11, 2025 - Affected: fixed in 9.11. - Fixed in 9.11.0 (released Dec 11, 2025, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2025-12765](https://cve.now/CVE-2025-12765): pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass. - Severity: High 7.5 - Published: Nov 13, 2025 - Affected: fixed in 9.10. - Fixed in 9.10.0 (released Nov 13, 2025, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2025-12764](https://cve.now/CVE-2025-12764): pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow. - Severity: High 7.5 - Published: Nov 13, 2025 - Affected: fixed in 9.10. - Fixed in 9.10.0 (released Nov 13, 2025, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2025-12763](https://cve.now/CVE-2025-12763): Command injection vulnerability allowing arbitrary command execution on Windows - Severity: Medium 6.8 - Published: Nov 13, 2025 - Affected: fixed in 9.10. - Fixed in 9.10.0 (released Nov 13, 2025, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2025-12762](https://cve.now/CVE-2025-12762): Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4) - Severity: Critical 9.1 - Published: Nov 13, 2025 - Affected: fixed in 9.10. - Fixed in 9.10.0 (released Nov 13, 2025, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2025-9636](https://cve.now/CVE-2025-9636): Cross-Origin Opener Policy Vulnerability in pgAdmin 4 - Severity: High 7.9 - Published: Sep 4, 2025 - Affected: fixed in 9.8. - Fixed in 9.8.0 (released Sep 4, 2025, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2025-2946](https://cve.now/CVE-2025-2946): Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data… - Severity: Critical 9.1 - Published: Apr 3, 2025 - Affected: fixed in 9.2. - Fixed in 9.2.0 (released Apr 3, 2025, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2025-2945](https://cve.now/CVE-2025-2945): pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment - Severity: Critical 9.9 - Published: Apr 3, 2025 - Affected: fixed in 9.2. - Fixed in 9.2.0 (released Apr 3, 2025, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2023-1907](https://cve.now/CVE-2023-1907): Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong session - Severity: High 8.0 - Published: Jan 9, 2025 - Affected: fixed in 7.0. - Fixed in 7.0.0 (released Apr 13, 2023, 637 days before disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2024-9014](https://cve.now/CVE-2024-9014): OAuth2 client id and secret exposed through the web browser in pgAdmin 4 - Severity: Critical 9.9 - Published: Sep 23, 2024 - Affected: fixed in 8.12. - Fixed in 8.12.0 (released Sep 23, 2024, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2024-4216](https://cve.now/CVE-2024-4216): XSS vulnerability in /settings/store API response json payload in pgAdmin 4 - Severity: High 7.4 - Published: May 2, 2024 - Affected: fixed in 8.6. - Fixed in 8.6.0 (released May 2, 2024, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2024-4215](https://cve.now/CVE-2024-4215): The Multi Factor Authentication bypass vulnerability in pgAdmin 4 - Severity: High 7.4 - Published: May 2, 2024 - Affected: fixed in 8.6. - Fixed in 8.6.0 (released May 2, 2024, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2024-3116](https://cve.now/CVE-2024-3116): Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4 - Severity: High 7.4 - Published: Apr 4, 2024 - Affected: fixed in 8.5. - Fixed in 8.5.0 (released Apr 4, 2024, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2024-2044](https://cve.now/CVE-2024-2044): Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4 - Severity: Critical 9.9 - Published: Mar 7, 2024 - Affected: fixed in 8.4. - Fixed in 8.4.0 (released Mar 7, 2024, the day of disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2023-5002](https://cve.now/CVE-2023-5002): Pgadmin4: remote code execution by an authenticated user - Severity: Medium 6.0 - Published: Sep 22, 2023 - Affected: fixed in 7.7. - Fixed in 7.7.0 (released Sep 21, 2023, 1 day before disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2023-0241](https://cve.now/CVE-2023-0241): pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. - Severity: Unrated - Published: Mar 27, 2023 - Affected: fixed in 6.19. - Fixed in 6.19.0 (released Jan 17, 2023, 69 days before disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2023-22298](https://cve.now/CVE-2023-22298): Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an… - Severity: Medium 6.1 - Published: Jan 17, 2023 - Affected: fixed in 6.14. - Fixed in 6.14.0 (released Sep 22, 2022, 117 days before disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2022-4223](https://cve.now/CVE-2022-4223): The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities… - Severity: High 8.8 - Published: Dec 13, 2022 - Affected: fixed in 6.17. - Fixed in 6.17.0 (released Dec 2, 2022, 11 days before disclosure). - The latest release, 9.19.0, is not affected. ### [CVE-2022-0959](https://cve.now/CVE-2022-0959): A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to… - Severity: Unrated - Published: Mar 16, 2022 - Affected: fixed in 6.7. - Fixed in 6.7.0 (released Mar 14, 2022, 2 days before disclosure). - The latest release, 9.19.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/pgadmin4 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.