pgAdmin Pgadmin 4 any version

Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4

pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment

OAuth2 client id and secret exposed through the web browser in pgAdmin 4

pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)

pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode

Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4

Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode

pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner

pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution

pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution

pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)

pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser

Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4

The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to properly secure this API, which could allow an unauthenticated user to call it with a path of their choosing, such as a UNC path to a server they control on a Windows machine. This would cause an appropriately named executable in the target path to be executed by the pgAdmin server.

pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout

Pgadmin4: remote code execution by an authenticated user

Command injection vulnerability allowing arbitrary command execution on Windows

pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution

pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates

pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution

The Multi Factor Authentication bypass vulnerability in pgAdmin 4

pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)

pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool

pgAdmin 4: SQL injection in named restore point endpoint

pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write

Cross-Origin Opener Policy Vulnerability in pgAdmin 4

pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution

pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.

pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass.

XSS vulnerability in /settings/store API response json payload in pgAdmin 4

pgAdmin 4 Installation Directory permission issue

pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools

pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpoints

pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046)

pgAdmin 4: Account-lockout bypass via Flask-Security default /login view

pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database.

A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write.

Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.