cve-2025-2945-poc

pgAdmin4 쿼리 도구 인증 RCE PoC pgAdmin4 8.10 - 9.1 버전에서 pgAdmin4 쿼리 도구 인증 RCE 취약점CVE-2025-2945을 악용하는 독립 실행형 파이썬 스크립트입니다. Metasploit 모듈에서 포팅됨: pgadminquerytoolauthenticated.rb 참조: https://vulners.com/cve/CVE-2025-2945 https://nvd.nist.gov/vuln/detail/CVE-2025-2945...

CVE-2025-2945

CVE-2025-2945 - pgAdmin4 인증 RCE 익스플로잇 작성자: G0D150NE 버전: 2.0.0 CVE: CVE-2025-2945 심각도: 치명적 CVSS 9.9 📌 설명 버전 8.109.1 에 영향을 주는 pgAdmin4 원격 코드 실행RCE 취약점에 대한 익스플로잇입니다. 이 취약점은 /sqleditor/querytool/download 엔드포인트에 존재하며, querycommited 매개변수가 Python의 eval 함수에 검증 없이 전달되어 임의 코드 실행을 허용합니다. ⚡ 기능 ✅ 자동 버전 감지 ✅ 여...

CVE-2025-2945-pgAdmin4-Authenticated-RCE-PoC-

CVE-2025-2945 – аутентифицированный RCE в pgAdmin4 PoC Этот репозиторий содержит скрипт proof-of-concept , созданный для исследований в области безопасности и авторизованного тестирования на проникновение, связанных с уязвимостью CVE-2025-2945 , затрагивающей определённые версии pgAdmin4. Проблем...

Exploit for Code Injection in Pgadmin Pgadmin_4

CVE-2025-2945 Contributors - 장원빈 @onxvynhttps://gith...

[SECURITY] Fedora 43 Update: pgadmin4-9.16-1.fc43

pgAdmin is the most popular and feature rich Open Source administration and d evelopment platform for PostgreSQL, the most advanced Open Source database in the world...

Cross-site Scripting (XSS)

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to Cross-site Scripting XSS via the html-react-parser process. An attacker can execute arbitrary JavaScript in the context of the victim's browser session by injecting malicious HTML through error messages or...

SQL Injection

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to SQL Injection via the description field in dialog templates when rendering SQL statements. An attacker can execute arbitrary SQL commands by submitting crafted input containing special characters to break...

Missing Authentication for Critical Function

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the closesqleditorsession and checktransactionstatus functions in the SQL Editor module, which lack proper authentication checks. An attacker can execute...

CVE-2026-12045

Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The AI Assistant's executesqlquery tool runs LLM-generated SQL inside a BEGIN...

CVE-2026-12044 pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates

SQL injection in pgAdmin 4 across every dialog template that renders COMMENT ON ... IS '' for a user-supplied description field. The Jinja templates for Domains and their constraints, Foreign Tables, Languages, and Event Triggers, plus the Views OID-lookup query, interpolated the description...

GHSA-HP84-P2GQ-6FVR vulnerabilities

Vulnerabilities for packages: pgadmin4...

CVE-2026-7815 vulnerabilities

Vulnerabilities for packages: pgadmin4...

GHSA-HR4R-FWPV-C95J vulnerabilities

Vulnerabilities for packages: pgadmin4...

GHSA-J74F-G7VX-FH4X vulnerabilities

Vulnerabilities for packages: pgadmin4...

GHSA-H2X2-Q2MC-24GW vulnerabilities

Vulnerabilities for packages: pgadmin4...

[SECURITY] Fedora 43 Update: pgadmin4-9.15-1.fc43

pgAdmin is the most popular and feature rich Open Source administration and d evelopment platform for PostgreSQL, the most advanced Open Source database in the world...

Access Control Bypass

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to Access Control Bypass via insufficient authorization checks in the API endpoints handling user-owned objects and shared server features. An attacker can gain unauthorized access to other users' private...

UNIX Symbolic Link (Symlink) Following

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following through the File Manager. An attacker can cause unauthorized file writes or overwrite arbitrary files by planting a symbolic link inside their own storage directory tha...

SQL Injection

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to SQL Injection via the Import/Export query export. An attacker can execute arbitrary commands on the server or write arbitrary files by injecting crafted input into the psql \copy metacommand template...

Deserialization of Untrusted Data

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the FileBackedSessionManager. An attacker can execute arbitrary code by placing a crafted serialized payload into the sessions directory, which is deserialized without...