CVE-2025-2945

CVE-2025-2945 - Exploit RCE autenticato in pgAdmin4 Autore: G0D150NE Versione: 2.0.0 CVE: CVE-2025-2945 Gravità: Critica CVSS 9.9 📌 Descrizione Exploit per la vulnerabilità di Remote Code Execution RCE in pgAdmin4 che interessa le versioni dalla 8.10 alla 9.1. La vulnerabilità è presente...

CVE-2025-2945-pgAdmin4-Authenticated-RCE-PoC-

CVE-2025-2945 – pgAdmin4 RCE autenticato PoC Questo repository contiene uno script proof-of-concept creato per la ricerca sulla sicurezza e per test di penetrazione autorizzati riguardanti la vulnerabilità CVE-2025-2945 , che colpisce determinate versioni di pgAdmin4. Il problema consente a un...

cve-2025-2945-poc

pgAdmin4 Query Tool Authenticated RCE PoC Script Python autonomo per sfruttare la vulnerabilità di RCE autenticata nel query tool di pgAdmin4 CVE-2025-2945 nelle versioni di pgAdmin4 8.10 - 9.1. Portato dal modulo Metasploit: pgadminquerytoolauthenticated.rb Riferimenti:...

GHSA-F66Q-9RF6-8795 vulnerabilities

Vulnerabilities for packages: pgadmin4...

Exploit for Code Injection in Pgadmin Pgadmin_4

CVE-2025-2945 Contributors - 장원빈 @onxvynhttps://gith...

[SECURITY] Fedora 43 Update: pgadmin4-9.16-1.fc43

pgAdmin is the most popular and feature rich Open Source administration and d evelopment platform for PostgreSQL, the most advanced Open Source database in the world...

Cross-site Scripting (XSS)

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to Cross-site Scripting XSS via the html-react-parser process. An attacker can execute arbitrary JavaScript in the context of the victim's browser session by injecting malicious HTML through error messages or...

SQL Injection

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to SQL Injection via the description field in dialog templates when rendering SQL statements. An attacker can execute arbitrary SQL commands by submitting crafted input containing special characters to break...

Missing Authentication for Critical Function

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the closesqleditorsession and checktransactionstatus functions in the SQL Editor module, which lack proper authentication checks. An attacker can execute...

CVE-2026-12045

Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The AI Assistant's executesqlquery tool runs LLM-generated SQL inside a BEGIN...

CVE-2026-12044 pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates

SQL injection in pgAdmin 4 across every dialog template that renders COMMENT ON ... IS '' for a user-supplied description field. The Jinja templates for Domains and their constraints, Foreign Tables, Languages, and Event Triggers, plus the Views OID-lookup query, interpolated the description...

GHSA-HP84-P2GQ-6FVR vulnerabilities

Vulnerabilities for packages: pgadmin4...

CVE-2026-7815 vulnerabilities

Vulnerabilities for packages: pgadmin4...

GHSA-HR4R-FWPV-C95J vulnerabilities

Vulnerabilities for packages: pgadmin4...

GHSA-J74F-G7VX-FH4X vulnerabilities

Vulnerabilities for packages: pgadmin4...

GHSA-H2X2-Q2MC-24GW vulnerabilities

Vulnerabilities for packages: pgadmin4...

[SECURITY] Fedora 43 Update: pgadmin4-9.15-1.fc43

pgAdmin is the most popular and feature rich Open Source administration and d evelopment platform for PostgreSQL, the most advanced Open Source database in the world...

Access Control Bypass

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to Access Control Bypass via insufficient authorization checks in the API endpoints handling user-owned objects and shared server features. An attacker can gain unauthorized access to other users' private...

UNIX Symbolic Link (Symlink) Following

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following through the File Manager. An attacker can cause unauthorized file writes or overwrite arbitrary files by planting a symbolic link inside their own storage directory tha...

SQL Injection

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to SQL Injection via the Import/Export query export. An attacker can execute arbitrary commands on the server or write arbitrary files by injecting crafted input into the psql \copy metacommand template...