CVE-2024-3116_RCE_in_pgadmin_8.4

CVE-2024-3116RCEinpgadmin8.4 Creando un laboratorio y probando la CVE-2024-3116, una ejecución remota de código en pgadmin 8.4 pip descargar el archivo .whl 8. Instalar pgadmin4: python -m pip install C:\Users\User\Downloads\pgadmin4-8.4-py3-none-any.whl Carpeta de instalación:...

CVE-2025-2945_PgAdmin_PoC

CVE-2025-2945PoC Prueba de concepto para pgAdmin RCE en la Herramienta de Consultas de pgAdmin CVE-2025-2945 – Prueba de Concepto en Python ⚠️ Descargo de responsabilidad Este repositorio contiene una prueba de concepto del exploit para CVE-2025-2945, una vulnerabilidad crítica de ejecución remota...

pgAdminOpendoor

pgAdminOpendoor CVE-2025-2945 Resumen Esta es mi investigación sobre CVE-2025-2945. Este repositorio incluye un entorno de prueba con PostgreSQL y pgAdmin vulnerable, y el exploit. CVE Enlaces útiles: Detalles NVD Análisis WIZ Metasploit Desglose En el backend de pgAdmin, que está escrito en...

pgAdmin 4 - Authentication Bypass

pgAdmin 4 versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data. id: CVE-2024-9014 info: name: pgAdmin 4 - Authentication Bypass author...

pgAdmin < 6.17 - Unauthenticated Remote Code Execution

pgAdmin prior to 6.17 contains an insecure HTTP API caused by improper access control, letting unauthenticated users execute arbitrary external utilities via path manipulation, exploit requires no authentication. id: CVE-2022-4223 info: name: pgAdmin 6.17 - Unauthenticated Remote Code Execution...

CVE-2024-9014

CVE-2024-9014 - pgAdmin 4 OAuth2 Authentication Bypass Exploit Tools This repository contains tools to check for and exploit the CVE-2024-9014 vulnerability in pgAdmin 4. The vulnerability allows an attacker to bypass OAuth2 authentication and access sensitive resources. Tools 1...

CVE-2024-9014

This post is a research article published by EQSTLab. CVE-2024-9014 ★ CVE-2024-9014 Sensitive Information Exposure PoC ★ Description CVE-2024-9014 : pgAdmin4 Sensitive Information Exposure description: pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication...

CVE-2025-13780

CVE-2025-13780: Escáner RCE para pgAdmin 4 = 8.14 Un escáner de vulnerabilidades integral para CVE-2025-13780 , una vulnerabilidad de ejecución remota de código RCE en pgAdmin 4 versiones ≤ 8.14. 🔍 Detalles de la vulnerabilidad La vulnerabilidad existe en la función Restore de pgAdmin 4. La...

CVE-2025-2945-pgAdmin-RCE

CVE-2025-2945 — pgAdmin 4 Authenticated Query Tool RCE CVSS 3.1: 9.9 Critical · Affects: pgAdmin 4 8.10 – 9.1 · Fixed in: 9.2 April 4, 2025 CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code / Eval Injection A proof-of-concept exploit for CVE-2025-2945, an authenticated...

CVE-2026-17566

CVE-2026-17566 — pgAdmin 4 Import/Export Data RCE PoC A remote code execution PoC for the pgAdmin 4 Import/Export Data tool. It exploits the divergence in backslash escaping semantics between the isqueryparensbalanced parenthesis checker and psql to inject \copy ... TO PROGRAM and execute arbitra...

Blackash-CVE-2025-12762

🔐 CVE-2025-12762 — Vulnerabilidad Crítica de RCE en pgAdmin 4 🚨 ¿Cuál es el problema? Existe una falla de Ejecución Remota de Código RCE en pgAdmin 4 versiones ≤ 9.9. Los atacantes pueden ejecutar comandos arbitrarios en el host cuando pgAdmin se ejecuta en modo servidor y procesa un volcado SQL ...

pgadmin4-9.10-CVE-2025-13780

pgadmin4 9.11 Meta-Command Filter Command Execution Summary The PLAIN restore meta-command filter introduced in pgAdmin as part of the fix for Issue 9320 does not detect meta-commands when a SQL file begins with a UTF-8 Byte Order Mark EF BB BF or other special sequences. The implemented filter...

CVE-2025-2945-pgadmin-rce

CVE-2025-2945 — pgAdmin 4 Query Tool Authenticated RCE Proof of concept for CVE-2025-2945, a critical remote code execution vulnerability in pgAdmin 4. Affected versions: 8.10 through 9.1 Fixed in: 9.2 released April 4, 2025 CVSS v3.1: 9.9 Critical Overview The pgAdmin 4 Query Tool exposes an...

CVE-2024-2044

PoC CVE-2024-2044: pgAdmin 4 RCE Autenticado Linux/POSIX Este repositorio contiene un script Proof of Concept PoC para CVE-2024-2044 , una vulnerabilidad crítica que combina Authenticated Path Traversal y Unsafe Deserialization en pgAdmin 4 versión 8.3 e inferiores ejecutándose en entornos...

[SECURITY] Fedora 43 Update: pgadmin4-9.18-1.fc43

pgAdmin is the most popular and feature rich Open Source administration and d evelopment platform for PostgreSQL, the most advanced Open Source database in the world...

pgadmin-ai-assistant-sql-injection-cve-2026-17351-lexer-differential-bypass

CVE-2026-17351 — pgAdmin 4 AI Assistant Read-Only Bypass via Lexer Differential PoC for CVE-2026-17351, a critical CVSS 9.0 SQL injection bypass in pgAdmin 4's AI Assistant. Vulnerability Summary pgAdmin 4 versions 9.13 through 9.16 use Python's sqlparse library to validate that LLM-generated SQL...

CVE-2026-86861

A flaw was found in pgAdmin 4. The File Manager's savefile endpoint, used for saving files from the Query Tool and ERD, did not properly handle symbolic links. An authenticated user with existing filesystem access to the pgAdmin host or a shared storage backend could exploit a timing window to...

CVE-2026-86862

A flaw was found in pgAdmin 4. Authenticated users with toolsrestore or toolsmaintenance permissions can exploit a connection-string injection issue in the Restore and Maintenance tools. By manipulating the 'database' field passed to the --dbname option of pgrestore and psql, an attacker can...

CVE-2026-86863

A flaw was found in pgAdmin 4. When the 'webserver' authentication source is enabled, a remote attacker can bypass authentication by supplying a client-controlled identity header. This allows the attacker to authenticate as any user, including an Administrator, without providing valid credentials...

CVE-2026-86864

A flaw was found in pgAdmin 4. An authenticated user with 'toolsbackup' permission can exploit an argument injection vulnerability in the Backup tool to create or overwrite arbitrary files on the system where pgAdmin is running. Additionally, a connection-string injection vulnerability allows the...