pgAdmin 4 - Authentication Bypass

pgAdmin 4 versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data. id: CVE-2024-9014 info: name: pgAdmin 4 - Authentication Bypass author...

pgAdmin < 6.17 - Unauthenticated Remote Code Execution

pgAdmin prior to 6.17 contains an insecure HTTP API caused by improper access control, letting unauthenticated users execute arbitrary external utilities via path manipulation, exploit requires no authentication. id: CVE-2022-4223 info: name: pgAdmin 6.17 - Unauthenticated Remote Code Execution...

CVE-2024-3116_RCE_in_pgadmin_8.4

CVE-2024-3116RCEinpgadmin8.4 Making a lab and testing the CVE-2024-3116, a Remote Code Execution in pgadmin 8.4 pip download .whl file 8. Install pgadmin4 : python -m pip install C:\Users\User\Downloads\pgadmin4-8.4-py3-none-any.whl Folder of installation :...

CVE-2025-2945_PgAdmin_PoC

CVE-2025-2945PoC pgAdmin Proof of Concept pgAdmin Query Tool RCE CVE-2025-2945 – Python Proof of Concept ⚠️ Disclaimer This repository contains a proof-of-concept exploit for CVE-2025-2945, a critical remote code execution vulnerability in pgAdmin 4 versions prior to 9.2. Use this code only in...

Blackash-CVE-2025-12762

🔐 CVE-2025-12762 — Critical RCE Vulnerability in pgAdmin 4 🚨 What’s the Issue? A Remote Code Execution RCE flaw exists in pgAdmin 4 versions ≤ 9.9. Attackers can run arbitrary commands on the host when pgAdmin is running in server mode and processes a PLAIN-format SQL dump during restore. ⚙️...

CVE-2025-2945-pgadmin-rce

CVE-2025-2945 — pgAdmin 4 Query Tool Authenticated RCE Proof of concept for CVE-2025-2945, a critical remote code execution vulnerability in pgAdmin 4. Affected versions: 8.10 through 9.1 Fixed in: 9.2 released April 4, 2025 CVSS v3.1: 9.9 Critical Overview The pgAdmin 4 Query Tool exposes an...

pgadmin4-9.10-CVE-2025-13780

pgadmin4 9.11 Meta-Command Filter Command Execution Summary The PLAIN restore meta-command filter introduced in pgAdmin as part of the fix for Issue 9320 does not detect meta-commands when a SQL file begins with a UTF-8 Byte Order Mark EF BB BF or other special sequences. The implemented filter...

pgAdminOpendoor

pgAdminOpendoor CVE-2025-2945 Overview This is my research on CVE-2025-2945. This repo includes a test stand with postgress and vulnerable pgadmin, and exploit. CVE Usefull links: NVD Details WIZ Analyze Metasploit Breakdown In pgAdmin backend, which is written in python, there are two endpoint...

CVE-2025-2945-pgAdmin-RCE

CVE-2025-2945 — pgAdmin 4 Authenticated Query Tool RCE CVSS 3.1: 9.9 Critical · Affects: pgAdmin 4 8.10 – 9.1 · Fixed in: 9.2 April 4, 2025 CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code / Eval Injection A proof-of-concept exploit for CVE-2025-2945, an authenticated...

CVE-2025-13780

CVE-2025-13780: pgAdmin 4 = 8.14 RCE Scanner A comprehensive vulnerability scanner for CVE-2025-13780 , a Remote Code Execution RCE vulnerability in pgAdmin 4 versions ≤ 8.14. 🔍 Vulnerability Details The vulnerability exists in the Restore feature of pgAdmin 4. The application attempts to block...

CVE-2024-9014

This post is a research article published by EQSTLab. CVE-2024-9014 ★ CVE-2024-9014 Sensitive Information Exposure PoC ★ Description CVE-2024-9014 : pgAdmin4 Sensitive Information Exposure description: pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication...

CVE-2026-116238

A flaw was found in pgAdmin 4 when operating in server mode. The application fails to properly enforce failed login limits on internal accounts due to exposed framework authentication endpoints, case-sensitivity discrepancies during username matching, and improper handling of multiple...

CVE-2024-9014

CVE-2024-9014 - pgAdmin 4 OAuth2 Authentication Bypass Exploit Tools This repository contains tools to check for and exploit the CVE-2024-9014 vulnerability in pgAdmin 4. The vulnerability allows an attacker to bypass OAuth2 authentication and access sensitive resources. Tools 1...

CVE-2026-17566

CVE-2026-17566 — pgAdmin 4 Import/Export Data RCE PoC A remote code execution PoC for the pgAdmin 4 Import/Export Data tool. It exploits the divergence in backslash escaping semantics between the isqueryparensbalanced parenthesis checker and psql to inject \copy ... TO PROGRAM and execute arbitra...

CVE-2024-2044

PoC CVE-2024-2044: pgAdmin 4 Authenticated RCE Linux/POSIX This repository contains a Proof of Concept PoC script for CVE-2024-2044 , a critical vulnerability that combines Authenticated Path Traversal and Unsafe Deserialization in pgAdmin 4 versions 8.3 and below running in a Linux/POSIX...

CVE-2026-116252

A flaw was found in pgAdmin 4. When a user refreshes a materialized view, the database name is passed to the underlying database client without proper sanitization, allowing connection parameters to be overridden. An authenticated attacker with database creation permissions can define a crafted...

CVE-2026-116249

A flaw was found in pgAdmin. In multi-user server mode, the application fails to properly restrict file paths and connection settings to a user's designated storage directory. An authenticated attacker can supply manipulated file paths to access sensitive credentials belonging to other users,...

SUSE CVE-2026-116238

In server mode pgAdmin 4 locks an internal account after MAXLOGINATTEMPTS failed logins 3 by default. The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration: ...

SUSE CVE-2026-116239

In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerberos authenticated a user, pgAdmin chose the account to log in by username alone, or took the account Flask-Security's...

SUSE CVE-2026-116240

In server mode pgAdmin 4 validates a path into the user's storage directory with checkaccesspermission, which builds the absolute path with getabspath. Several callers then acted on a path they built differently, so the path checked and the path used could name different files: - Opening a file i...