Product by Pgadmin.org
Pgadmin 4
56 known vulnerabilities in Pgadmin 4 (Pgadmin.org), 0 of them actively exploited (CISA KEV).
Key figures
56
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
17
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-2945 | pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment | 9.9 | |
| Critical | CVE-2024-2044 | Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4 | 9.9 | |
| Critical | CVE-2025-12762 | Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4) | 9.1 | |
| Critical | CVE-2024-9014 | OAuth2 client id and secret exposed through the web browser in pgAdmin 4 | 9.9 | |
| Critical | CVE-2024-3116 | Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4 | 7.4 | |
| High | CVE-2026-7816 | pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout | 8.8 | |
| Critical | CVE-2026-12046 | Pgadmin.org pgAdmin 4: Missing Authentication for Critical Function | 9.0 | |
| Critical | CVE-2026-86863 | Pgadmin.org pgAdmin 4: Authentication Bypass by Spoofing | 9.8 | |
| Critical | CVE-2026-17566 | Pgadmin.org pgAdmin 4: OS Command Injection | 9.9 | |
| High | CVE-2026-86864 | pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool | 8.8 | |
| High | CVE-2026-17347 | pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution | 8.8 | |
| Critical | CVE-2025-13780 | Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4) | 9.1 | |
| Critical | CVE-2026-12045 | Pgadmin.org pgAdmin 4: SQL Injection | 8.8 | |
| High | CVE-2026-12044 | Pgadmin.org pgAdmin 4: SQL Injection | 8.8 | |
| High | CVE-2026-17346 | Pgadmin.org pgAdmin 4: SQL Injection | 8.8 | |
| Critical | CVE-2026-17351 | Pgadmin.org pgAdmin 4: SQL Injection | 9.0 | |
| Critical | CVE-2026-116241 | Pgadmin.org pgAdmin 4: OS Command Injection | 9.9 | |
| Critical | CVE-2026-7813 | pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode | 9.9 | |
| Critical | CVE-2026-17349 | Pgadmin.org pgAdmin 4: Authorization Bypass Through User-Controlled Key | 9.6 | |
| Critical | CVE-2026-116238 | Pgadmin.org pgAdmin 4: Improper Restriction of Excessive Authentication Attempts | 8.1 | |
| High | CVE-2025-12763 | Command injection vulnerability allowing arbitrary command execution on Windows | 6.8 | |
| High | CVE-2026-116239 | pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username | 8.5 | |
| High | CVE-2026-12050 | pgAdmin 4: SQL injection in named restore point endpoint | 8.8 | |
| High | CVE-2026-7815 | pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution | 8.8 | |
| High | CVE-2026-1707 | Restore restriction bypass via key disclosure vulnerability (pgAdmin 4) | 7.4 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 30sans-atrisk-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 25sans-atrisk-mail,