Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um beliebigen Programmcode, oder Cross-Site Scripting auszuführen.
Product
pgAdmin ist eine Verwaltungs- und Entwicklungsplattform für die PostgreSQL-Datenbank.
Vulnerabilities 2
-
Critical 9.9
pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment
Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, wher…
-
Critical 9.1
Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4
pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.
Revision history
-
#4
Exploit für CVE-2025-2945 aufgenommen
-
#3
Neue Updates von Fedora aufgenommen
-
#2
Neue Updates von openSUSE aufgenommen
-
#1
Initiale Fassung
References
-
pgAdmin Release Notes vom 2025-04-03
http://www.pgadmin.org/news/#109
-
GitHub Advisory Database vom 2025-04-03
https://github.com/advisories/GHSA-g73c-fw68-pwx3
-
GitHub Advisory Database vom 2025-04-03
https://github.com/advisories/GHSA-2rrx-pphc-qfv9
-
openSUSE Security Update OPENSUSE-SU-2025:14983-1 vom 2025-04-11
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/BYON52PV4P44MGBG55FDOG2SP2G266ZO/
-
Fedora Security Advisory FEDORA-2025-49D6F62C0E vom 2025-04-17
https://bodhi.fedoraproject.org/updates/FEDORA-2025-49d6f62c0e
-
pgAdminOpendoor Exploit (CVE-2025-2945) vom 2025-11-11
https://github.com/I3r1h0n/pgAdminOpendoor/tree/main