138 matches found
CVE-2025-2945
CVE-2025-2945 affects pgAdmin 4 (versions 8.10–9.1). An authenticated user can trigger remote code execution by sending a crafted payload via the query_tool/download (query_commited) or cloud/deploy (high_availability) endpoints, which unsafe-pass data to Python eval(). Proofs of concept exist (a...
CVE-2024-9014 OAuth2 client id and secret exposed through the web browser in pgAdmin 4
pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data...
ROS-20240904-13
A vulnerability in the session cookie pga4session of the pgAdmin 4 database management tool is related to an incorrect serialization. Exploitation of the vulnerability could allow an attacker acting remotely, execute arbitrary code...
The vulnerability of the pgAdmin 4 database management tool, related to permission handling errors, allows a hacker to execute arbitrary code.
The vulnerability of the pgAdmin 4 database management tool is related to permission handling errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
CVE-2024-6238 pgAdmin 4 Installation Directory permission issue
pgAdmin = 8.8 has an installation Directory permission issue. Because of this issue, attackers can gain unauthorised access to the installation directory on the Debian or RHEL 8 platforms...
CVE-2024-4216 XSS vulnerability in /settings/store API response json payload in pgAdmin 4
pgAdmin = 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script at the client end...
CVE-2024-4216 XSS vulnerability in /settings/store API response json payload in pgAdmin 4
pgAdmin = 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script at the client end...
CVE-2024-4215 The Multi Factor Authentication bypass vulnerability in pgAdmin 4
pgAdmin = 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files an...
CVE-2024-3116 Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4
pgAdmin = 8.4 is affected by a Remote Code Execution RCE vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the...
CVE-2024-3116 Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4
pgAdmin = 8.4 is affected by a Remote Code Execution RCE vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the...
pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user
pgAdmin prior to version 8.4 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is...
GHSA-RJ98-CRF4-G69W pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user
pgAdmin prior to version 8.4 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is...
CVE-2024-2044 Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4
pgAdmin = 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on...
CVE-2024-2044
CVE-2024-2044 affects pgAdmin4
ROS-20231011-01
A vulnerability in the HTTP API of the pgAdmin 4 database management tool is related to insufficient input data validation. verification of input data. Exploitation of the vulnerability could allow an attacker acting remotely, execute arbitrary commands on the server...
The vulnerability of the HTTP application programming interface of the database management tool pgAdmin 4 allows a hacker to execute arbitrary commands on the server.
The vulnerability of the HTTP application programming interface of the database management tool pgAdmin 4 relates to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on the server remotely...
SUSE SLES15 / openSUSE 15 Security Update : pgadmin4 (SUSE-SU-2023:1877-1)
The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:1877-1 advisory. - CVE-2023-0241: Fixed a directory traversal vulnerability bsc1207464. Tenable has extracted the preceding description block...
pgAdmin 4 vulnerable to directory traversal
pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database...
