Pgadmin.org vulnerabilities
56 CVEs and advisories name Pgadmin.org as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-12045pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution
- CVE-2026-12050pgAdmin 4: SQL injection in named restore point endpoint
- CVE-2026-12044pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates
- CVE-2026-7820pgAdmin 4: Account-lockout bypass via Flask-Security default /login view
- CVE-2026-7819pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write
- CVE-2026-7818pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution
- CVE-2026-7817pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpoints
- CVE-2026-7816pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout
- CVE-2026-7815pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution
- CVE-2026-7814pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer
- CVE-2026-7813pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode
- CVE-2026-1707Restore restriction bypass via key disclosure vulnerability (pgAdmin 4)
- CVE-2025-13780Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)
- CVE-2025-12765pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass.
- CVE-2025-12764pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.
- CVE-2025-12763Command injection vulnerability allowing arbitrary command execution on Windows
- CVE-2025-12762Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)
- CVE-2025-9636Cross-Origin Opener Policy Vulnerability in pgAdmin 4
- CVE-2025-2946Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4
- CVE-2025-2945pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment
- CVE-2024-9014OAuth2 client id and secret exposed through the web browser in pgAdmin 4
- CVE-2024-6238pgAdmin 4 Installation Directory permission issue
- CVE-2024-4216XSS vulnerability in /settings/store API response json payload in pgAdmin 4
- CVE-2024-4215The Multi Factor Authentication bypass vulnerability in pgAdmin 4
- CVE-2024-3116Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4
- CVE-2024-2044Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4