The vulnerability of the LDAP authentication configuration in Server Mode of the pgAdmin 4 database management tool allows a hacker to bypass security restrictions and gain unauthorized access to protected information.

The vulnerability of the LDAP authentication configuration in the Server Mode mode of the pgAdmin 4 database management tool is related to improper session fixation due to incorrect access control. Exploiting this vulnerability can allow an attacker to bypass security restrictions and gain...

The vulnerability of the eval() function in Cloud Deployment modules and the Query Tool, a database management tool for pgAdmin 4, allows a hacker to execute arbitrary code.

The vulnerability of the eval function in the Cloud Deployment and Query Tool modules of the pgAdmin 4 database management tool is related to improper code generation during processing of endpoints like /sqleditor/querytool/download and /cloud/deploy, when the querycommited and highavailability...

The vulnerability of the pgAdmin 4 database management tool, related to the lack of authentication, allows a hacker to bypass the authentication checks and execute arbitrary code.

The vulnerability of the pgAdmin 4 database management tool is related to the absence of authentication. Exploiting this vulnerability allows a malicious actor to bypass authentication checks and execute arbitrary code...

SUSE CVE-2025-2945

Remote Code Execution security vulnerability in pgAdmin 4 Query Tool and Cloud Deployment modules. The vulnerability is associated with the 2 POST endpoints; /sqleditor/querytool/download, where the querycommited parameter and /cloud/deploy endpoint, where the highavailability parameter is unsafe...

Cross-site Scripting (XSS)

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to Cross-site Scripting XSS in the measureText function, accessible via the Query Tool interface. An attacker can inject malicious scripts into the displayed output. PoC sql CREATE TABLE IF NOT EXISTS EXAMPLE...

Remote Code Execution (RCE)

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to Remote Code Execution RCE in the Cloud Deployment with Google Provider module, which is accessible via the highavailability parameter to the /deploy endpoint and in the Query Tool interface, which is...

CVE-2025-2945

Remote Code Execution security vulnerability in pgAdmin 4 Query Tool and Cloud Deployment modules. The vulnerability is associated with the 2 POST endpoints; /sqleditor/querytool/download, where the querycommited parameter and /cloud/deploy endpoint, where the highavailability parameter is unsafe...

Security update for pgadmin4

This update for pgadmin4 fixes the following issues: CVE-2024-4216: Fixed XSS in /settings/store endpoint bsc1223868 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed...

The vulnerability in the implementation of the OAuth2 protocol for managing databases in pgAdmin 4 allows a perpetrator to increase their privileges.

The vulnerability of the OAuth2 protocol implementation in the pgAdmin 4 database management tool is related to insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

The vulnerability of the pgAdmin 4 database management tool arises from an incorrect path name limitation for the restricted access directory, allowing a hacker to execute arbitrary code.

The vulnerability of the pgAdmin 4 database management tool exists due to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the pga4_session cookie file of the database management tool pgAdmin 4 allows a hacker to execute arbitrary code.

The vulnerability of the pga4session cookie file of the database management tool pgAdmin 4 is related to incorrect serialization. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the Server mode setting in the pgAdmin 4 database management tool allows a hacker to alter the settings of another user or the database itself.

The vulnerability of the Server mode of the pgAdmin 4 database management tool is related to shortcomings in the name restriction of the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to alter the settings of another user or the database...

SUSE CVE-2023-22298

Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL...

pgAdmin 4 vulnerable to directory traversal

Overview PostgreSQL management tool pgAdmin 4 contains a directory traversal vulnerability CWE-22. Yuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A user ...

PT-2023-2031

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to v6.19 Description The issue is related to a directory traversal vulnerability in pgAdmin 4. This vulnerability can be exploited by a remote attacker to change another user's settings or alter the database. The...

faradaysec (>=3.14.1 <=3.14.4), flask-authoob (>=0.0.21 <=0.0.34) +4 more potentially affected by CVE-2021-32618 via flask-security-too (>=3.2.0rc1 <=4.0.1)

flask-security-too PYPI version =3.2.0rc1, =3.14.1, =0.0.21, =0.3.1, =4.22.0, =6.0.1, =6.0.0, =6.4.0 Source cves: CVE-2021-32618 Source advisory: SNYK:PYTHON-FLASKSECURITYTOO-1293190...