Skip to content
OpenAdvisories

Vendor

pgadmin.org

56 known vulnerabilities.

Products

pgAdmin 4 56
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 8.2
    CVE-2026-116244 Public exploit

    pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials

    When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to the default credential cache, or a client keytab, of the operating-system account r…

    pgadmin.org pgAdmin 4
  • Critical 9.9
    CVE-2026-17566 Public exploit

    pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)

    pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create…

    pgadmin.org pgAdmin 4
  • Critical 9.1
    CVE-2025-13780 Public exploit

    Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

    pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the s…

    pgadmin.org pgAdmin 4 pgadmin4 PyPI
  • Critical 9.1
    CVE-2025-12762 Public exploit EPSS 13%

    Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

    pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the se…

    pgadmin.org pgAdmin 4 pgadmin4 PyPI
  • Critical 9.9
    CVE-2025-2945 Public exploit EPSS 56%

    pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment

    Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, wher…

    pgadmin.org pgAdmin 4 pgadmin4 PyPI
  • Critical 9.9
    CVE-2024-9014 Public exploit

    OAuth2 client id and secret exposed through the web browser in pgAdmin 4

    pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

    pgadmin.org pgAdmin 4 pgadmin4 PyPI
  • High 7.4
    CVE-2024-3116 Public exploit EPSS 66%

    Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4

    pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system…

    pgadmin.org pgAdmin 4 pgadmin4 PyPI
  • Critical 9.9
    CVE-2024-2044 Public exploit EPSS 79%

    Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4

    pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execut…

    pgadmin.org pgAdmin 4 pgadmin4 PyPI