CVE-2022-4223

CVE-2022-4223 describes a remote code execution vulnerability in pgAdmin that affects versions prior to 6.17. An insecure HTTP API allows an unauthenticated user to pass a manipulated path (e.g., a UNC path) to the server, which could lead to the execution of an arbitrary executable on the pgAdmi...

CVE-2022-0959

CVE-2022-0959 affects pgAdmin4: a malicious, authenticated user can craft an HTTP request using an existing CSRF token and session cookie to upload files to any location writable by the OS user running pgAdmin. The root cause is an unrestricted file upload path that permits writes outside intende...