CVE-2023-5002

CVE-2023-5002 affects pgAdmin’s server HTTP API where path validation for external PostgreSQL utilities (e.g., pg_dump/pg_restore) was insufficient. An authenticated user could cause the server to execute arbitrary commands due to improper control of server-side code. Reports across multiple sour...

CVE-2023-0241

pgAdmin 4 contains a directory traversal vulnerability in versions prior to v6.19. The flaw could allow a user to change another user’s settings or alter the database. Multiple sources corroborate the issue (CVE-2023-0241) and note remediation via updates; open advisories reference a fixed releas...

CVE-2023-22298

CVE-2023-22298 is an open redirect vulnerability in pgAdmin 4 prior to version 6.14. An unauthenticated remote attacker can lure a user to click a specially crafted URL, redirecting them to an arbitrary site and enabling phishing. Affected software is pgAdmin 4; the root cause is an improper redi...