{"kind": "product", "path": "vulns/pypi/pgadmin4", "name": "pgadmin4", "product": "pgadmin4", "ecosystem": "PyPI", "items": [{"id": "CVE-2026-7820", "noindex": false, "published": "2026-05-11T14:35:53.492Z", "modified": "2026-05-11T16:04:54.699Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00211, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-7820", "title": "pgAdmin 4: Account-lockout bypass via Flask-Security default /login view", "description": "Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4.\n\npgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custom /authenticate/login view. Flask-Security's default /login view, which is registered automatically by security.init_app() and is reachable on every server, never consulted the User.locked field: pgAdmin's User model relied on Flask-Security's UserMixin.is_locked() (which always returns 'not locked') and Flask-Login's is_active (which only checks the active column, not locked). An attacker who triggered an account lockout via /authenticate/login could therefore obtain a session by re-submitting valid cred", "references": ["https://github.com/pgadmin-org/pgadmin4/issues/9904", "https://nvd.nist.gov/vuln/detail/CVE-2026-7820"], "fixes": ["9.15"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-7819", "noindex": false, "published": "2026-05-11T14:35:52.747Z", "modified": "2026-05-11T16:06:03.147Z", "cvss": 7.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00325, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-7819", "title": "pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write", "description": "Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager.\n\ncheck_access_permission used os.path.abspath, which resolves '..' but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An authenticated user could plant a symbolic link inside their own storage directory pointing outside it and induce pgAdmin to write to any path reachable by the pgAdmin process.\n\nFix switches the access check to os.path.realpath for both source and destination, and adds an _open_upload_target helper that opens the target with O_NOFOLLOW (mode 0o600) to close the leaf-component TOCTOU between the access check and the ", "references": ["https://github.com/pgadmin-org/pgadmin4/issues/9902", "https://nvd.nist.gov/vuln/detail/CVE-2026-7819"], "fixes": ["9.15"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-7818", "noindex": false, "published": "2026-05-11T14:35:52.092Z", "modified": "2026-05-11T16:07:11.650Z", "cvss": 7.3, "cvss_vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00131, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-7818", "title": "pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution", "description": "Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager.\n\nThe session manager performed unsafe deserialization of session-file contents (using Python's standard object-serialization module) before performing any HMAC integrity check. Any file dropped into the sessions directory was deserialized unconditionally. An authenticated user with write access to the sessions directory (whether by misconfiguration or in combination with another path-traversal flaw) could plant a crafted serialized payload to achieve operating-system level remote code execution under the pgAdmin process identity.\n\nFix prepends a 64-byte hex SHA", "references": ["https://github.com/pgadmin-org/pgadmin4/issues/9901", "https://nvd.nist.gov/vuln/detail/CVE-2026-7818"], "fixes": ["9.15"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-7817", "noindex": false, "published": "2026-05-11T14:35:51.384Z", "modified": "2026-05-11T16:07:55.788Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00217, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-7817", "title": "pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpoints", "description": "Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.\n\nUser-supplied api_key_file and api_url preferences were passed to the LLM provider clients without validation. An authenticated user could read arbitrary server-side files by pointing api_key_file at any path readable by the pgAdmin process, or coerce pgAdmin into making requests to internal targets (e.g. cloud metadata services such as 169.254.169.254) by setting api_url, exploiting the chat path and model-list endpoints.\n\nFix restricts api_key_file to the user's private storage (server mode) or home directory (des", "references": ["https://github.com/pgadmin-org/pgadmin4/issues/9900", "https://nvd.nist.gov/vuln/detail/CVE-2026-7817"], "fixes": ["9.15"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-7816", "noindex": false, "published": "2026-05-11T14:35:50.827Z", "modified": "2026-05-26T13:39:15.001Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.01444, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-7816", "title": "pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout", "description": "OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export.\n\nUser-supplied input was interpolated directly into a psql \\copy metacommand template without sanitization. An authenticated user could inject \") TO PROGRAM 'cmd'\" to break out of the \\copy (...) context and achieve arbitrary command execution on the pgAdmin server, or \") TO '/path'\" for arbitrary file write. Additional fields (format, on_error, log_verbosity) were also raw-interpolated and exploitable.\n\nFix adds a parens-balance parser modeled on psql's strtokx tokenizer, allow-lists format/on_error/log_verbosity, rejects null bytes in the query, and tighten", "references": ["https://github.com/pgadmin-org/pgadmin4/issues/9899", "https://nvd.nist.gov/vuln/detail/CVE-2026-7816"], "fixes": ["9.15"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-7815", "noindex": false, "published": "2026-05-11T14:35:50.081Z", "modified": "2026-05-11T16:09:33.147Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00456, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-7815", "title": "pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution", "description": "SQL injection vulnerability in pgAdmin 4 Maintenance Tool.\n\nFour user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host.\n\nFix introduces server-side allow-listing of all four fields and switches reindex_ta", "references": ["https://github.com/pgadmin-org/pgadmin4/issues/9898", "https://nvd.nist.gov/vuln/detail/CVE-2026-7815"], "fixes": ["9.15"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-7814", "noindex": false, "published": "2026-05-11T14:35:49.411Z", "modified": "2026-05-11T17:31:37.625Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00163, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-7814", "title": "pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer", "description": "Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules.\n\nUser-controlled PostgreSQL object names (database, schema, table, column, etc.) were assigned to DOM elements via innerHTML, allowing crafted object names containing HTML markup to execute attacker-supplied JavaScript in the browser of any pgAdmin user who navigated to or executed EXPLAIN over the malicious object.\n\nFix replaces innerHTML with textContent.\n\nThis issue affects pgAdmin 4: before 9.15.", "references": ["https://github.com/pgadmin-org/pgadmin4/pull/9865", "https://github.com/pgadmin-org/pgadmin4/issues/9865", "https://nvd.nist.gov/vuln/detail/CVE-2026-7814"], "fixes": ["9.15"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-7813", "noindex": false, "published": "2026-05-11T14:35:48.717Z", "modified": "2026-05-11T17:32:49.824Z", "cvss": 9.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00455, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-7813", "title": "pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode", "description": "Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.\n\nMultiple endpoints fetched user-owned objects without filtering by the requesting user's identity. An authenticated user could access another user's private servers, server groups, background processes, and debugger function arguments by guessing object IDs.\n\nAdditionally, the Shared Servers feature contained multiple issues including credential leakage (passexec_cmd, passfile, SSL keys), privilege escalation via writable passexec_cmd (a shell command executed when establishing the connection) all", "references": ["https://github.com/pgadmin-org/pgadmin4/pull/9830", "https://github.com/pgadmin-org/pgadmin4/pull/9835", "https://nvd.nist.gov/vuln/detail/CVE-2026-7813"], "fixes": ["9.15"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-1707", "noindex": false, "published": "2026-02-05T17:30:05.089Z", "modified": "2026-02-26T21:50:19.579Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "severity": "high", "epss": 0.00439, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-1707", "title": "Restore restriction bypass via key disclosure vulnerability (pgAdmin 4)", "description": "pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract the `\\restrict` key in real time, and race the restore process by overwriting the restore script with a payload that re-enables meta-commands using `\\unrestrict <key>`. This results in reliable command execution on the pgAdmin host during the restore operation.", "references": ["https://github.com/pgadmin-org/pgadmin4/issues/9518", "https://nvd.nist.gov/vuln/detail/CVE-2026-1707"], "fixes": ["9.12"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-13780", "noindex": false, "published": "2025-12-11T18:30:47.812Z", "modified": "2026-02-26T16:07:46.344Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "severity": "critical", "epss": 0.00943, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-13780", "title": "Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)", "description": "pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.", "references": ["https://github.com/pgadmin-org/pgadmin4/issues/9368", "https://nvd.nist.gov/vuln/detail/CVE-2025-13780"], "fixes": ["9.11"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-12765", "noindex": false, "published": "2025-11-13T13:00:11.448Z", "modified": "2025-11-13T14:00:56.314Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.0023, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-12765", "title": "pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass.", "description": "pgAdmin <= 9.9  is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.", "references": ["https://github.com/pgadmin-org/pgadmin4/issues/9324", "https://nvd.nist.gov/vuln/detail/CVE-2025-12765"], "fixes": ["9.10"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-12764", "noindex": false, "published": "2025-11-13T13:00:10.595Z", "modified": "2025-11-13T14:02:00.502Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00476, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-12764", "title": "pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.", "description": "pgAdmin <= 9.9  is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.", "references": ["https://github.com/pgadmin-org/pgadmin4/issues/9325", "https://nvd.nist.gov/vuln/detail/CVE-2025-12764"], "fixes": ["9.10"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-12763", "noindex": false, "published": "2025-11-13T13:00:08.048Z", "modified": "2026-02-26T16:57:06.806Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "severity": "medium", "epss": 0.00914, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-12763", "title": "Command injection vulnerability allowing arbitrary command execution on Windows", "description": "pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input.", "references": ["https://github.com/pgadmin-org/pgadmin4/issues/9323", "https://nvd.nist.gov/vuln/detail/CVE-2025-12763"], "fixes": ["9.10"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-12762", "noindex": false, "published": "2025-11-13T13:00:02.005Z", "modified": "2026-02-26T16:57:07.296Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "severity": "critical", "epss": 0.12705, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-12762", "title": "Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)", "description": "pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.", "references": ["https://github.com/pgadmin-org/pgadmin4/issues/9320", "https://nvd.nist.gov/vuln/detail/CVE-2025-12762"], "fixes": ["9.10"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-9636", "noindex": false, "published": "2025-09-04T16:43:27.710Z", "modified": "2026-02-26T17:49:38.292Z", "cvss": 7.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L", "severity": "high", "epss": 0.00227, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-9636", "title": "Cross-Origin Opener Policy Vulnerability in pgAdmin 4", "description": "pgAdmin <= 9.7 is affected by a  Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.", "references": ["https://github.com/pgadmin-org/pgadmin4/issues/9114", "https://nvd.nist.gov/vuln/detail/CVE-2025-9636"], "fixes": ["9.8"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-2946", "noindex": false, "published": "2025-04-03T12:23:30.694Z", "modified": "2025-04-03T17:57:18.517Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H", "severity": "critical", "epss": 0.00329, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-2946", "title": "Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4", "description": "pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.", "references": ["https://github.com/pgadmin-org/pgadmin4/issues/8602", "https://nvd.nist.gov/vuln/detail/CVE-2025-2946"], "fixes": ["9.2"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-2945", "noindex": false, "published": "2025-04-03T12:23:14.792Z", "modified": "2026-02-26T18:28:58.124Z", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.563, "kev": false, "exploits": ["metasploit", "public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-2945", "title": "pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment", "description": "Remote Code Execution security vulnerability in pgAdmin 4  (Query Tool and Cloud Deployment modules).\n\nThe vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.\n\n\nThis issue affects pgAdmin 4: before 9.2.", "references": ["https://github.com/pgadmin-org/pgadmin4/issues/8603", "https://nvd.nist.gov/vuln/detail/CVE-2025-2945"], "fixes": ["9.2"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-1907", "noindex": false, "published": "2025-01-09T07:26:48.686Z", "modified": "2025-08-27T11:04:15.329Z", "cvss": 8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00445, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-1907", "title": "Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong session", "description": "A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously.", "references": ["https://access.redhat.com/security/cve/CVE-2023-1907", "https://bugzilla.redhat.com/show_bug.cgi?id=2218384", "https://nvd.nist.gov/vuln/detail/CVE-2023-1907"], "fixes": ["7.0"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-9014", "noindex": false, "published": "2024-09-23T17:04:00.264Z", "modified": "2024-09-23T19:21:22.348Z", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.09685, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-9014", "title": "OAuth2 client id and secret exposed through the web browser in pgAdmin 4", "description": "pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.", "references": ["https://github.com/pgadmin-org/pgadmin4/issues/7945", "https://nvd.nist.gov/vuln/detail/CVE-2024-9014"], "fixes": ["8.12"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-4216", "noindex": false, "published": "2024-05-02T17:42:59.679Z", "modified": "2025-02-13T17:53:31.153Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "severity": "high", "epss": 0.00461, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-4216", "title": "XSS vulnerability in /settings/store API response json payload in pgAdmin 4", "description": "pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script at the client end.", "references": ["https://github.com/pgadmin-org/pgadmin4/issues/7282", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/", "https://nvd.nist.gov/vuln/detail/CVE-2024-4216"], "fixes": ["8.6"], "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}]}], "total": 28, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "pgadmin4", "path": "vulns/pypi/pgadmin4", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-05-26T13:39:15.001Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}