P4
Product
Pgadmin 4
46
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 9High 19Medium 18Low 0
Watch
Add Pgadmin 4 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-86862 | 6.5 | Sep 17 | pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools Affected: before 9.18 |
| CVE-2026-17348 | 6.5 | Jul 31 | pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046) Affected: 1.0 before 9.17 |
| CVE-2026-7820 | 6.5 | May 11 | pgAdmin 4: Account-lockout bypass via Flask-Security default /login view Affected: before 9.15 |
| CVE-2026-7817 | 6.5 | May 11 | pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpoints Affected: 9.13 before 9.15 |
| CVE-2024-9014 | 6.5 | Sep 23 | pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication Affected: before 8.12 |
| CVE-2023-0241 | 6.5 | Mar 27 | pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability Affected: before 6.19 |
| CVE-2022-0959 | 6.5 | Mar 16 | A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that… Affected: before 6.7 |
| CVE-2026-1707 | 6.3 | Feb 5 | pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from… Affected: 9.11 |
| CVE-2026-12049 | 6.1 | Jun 18 | pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameter Affected: 6.0 before 9.16 |
| CVE-2025-2946 | 6.1 | Apr 3 | pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS) Affected: through 9.1 |
| CVE-2023-22298 | 6.1 | Jan 17 | Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack… Affected: 4.0 before 6.14 |
| CVE-2026-86861 | 5.9 | Sep 17 | pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment check Affected: before 9.18 |
| CVE-2026-17350 | 5.4 | Jul 31 | pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers Affected: 9.3 before 9.17 |
| CVE-2026-12048 | 5.4 | Jun 18 | pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser Affected: 6.0 before 9.16 |
| CVE-2026-12047 | 5.4 | Jun 18 | pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception text Affected: 6.6 before 9.16 |
| CVE-2024-4216 | 5.4 | May 2 | pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload Affected: before 8.6 |
| CVE-2024-6238 | 5.3 | Jun 25 | pgAdmin <= 8.8 has an installation Directory permission issue. Because of this issue, attackers can gain unauthorised access to the installation directory on the Debian or RHEL 8… Affected: before 8.9 |
| CVE-2026-7814 | 4.8 | May 11 | pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer Affected: 6.9 before 9.15 |
Showing 18