CVE-2026-7814
CVE-2026-7814 · pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules. User-controlled PostgreSQL object names (database, schema, table, column, etc.) were assigned to DOM elements via innerHTML, allowing crafted object names containing HTML markup to execute attacker-supplied JavaScript in the browser of any pgAdmin user who navigated to or executed EXPLAIN over the malicious object. Fix replaces innerHTML with textContent. This issue affects pgAdmin 4: before 9.15.
CVSS 4.8 · Media · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: python
Productos y versiones afectados
pgadmin 4
- Versiones
- ≥ 6.9, < 9.15: Afectada (custom)
Actualiza a 9.15
pgadmin4 PyPI
- Versiones
- 4.20
- 4.22
- 4.23
- 4.24
- 4.25
- 4.26
- 4.27
- 4.28
- 4.29
- 4.30
- 5.0
- 5.1
- 5.2
- 5.3
- 5.4
- 5.5
- 5.6
- 5.7
- 6.10
- 6.11
- 6.12
- 6.13
- 6.14
- 6.15
- 6.16
- 6.17
- 6.18
- 6.19
- 6.2
- 6.20
- 6.21
- 6.3
- 6.4
- 6.5
- 6.6
- 6.7
- 6.8
- 6.9
- 7.0
- 7.1
- 7.2
- 7.3
- 7.4
- 7.5
- 7.6
- 7.7
- 7.8
- 8.0
- 8.1
- 8.10
- 8.11
- 8.12
- 8.13
- 8.14
- 8.2
- 8.3
- 8.4
- 8.5
- 8.6
- 8.7
- 8.8
- 8.9
- 9.0
- 9.1
- 9.10
- 9.11
- 9.12
- 9.13
- 9.14
- 9.2
- 9.3
- 9.4
- 9.5
- 9.6
- 9.7
- 9.8
- 9.9
- Intervalos de versiones afectados
- ECOSYSTEM: < 9.15
Actualiza a 9.15