Skip to content
Noroxi

pgadmin records

63 published records for vendor pgadmin. 0 of them have been exploited in the wild (listed in CISA KEV) and 3 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
3 · 4.8%
Pre-auth RCE
5
With a fix record
66.7%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 22
  2. 23
  3. 24
  4. 25
  5. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

63 records
  • CVE-2024-2044
    63This week

    Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4

    CriticalCVSS 9.9WeaponizedEPSS 79%

    pgadmin · pgadmin 4Mar 7, 2024

  • CVE-2024-3116
    60This week

    Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4

    CriticalCVSS 9.8WeaponizedEPSS 65%

    pgadmin · pgadmin 4Apr 4, 2024

  • CVE-2022-4223
    59Plan

    The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities suc

    HighCVSS 8.8Proof of conceptEPSS 80%

    pgadmin · pgadmin 4Dec 13, 2022

  • CVE-2025-2945
    52Plan

    pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment

    HighCVSS 8.8WeaponizedEPSS 56%

    pgadmin · pgadmin 4Apr 3, 2025

  • CVE-2025-12762
    43Plan

    Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    pgadmin · pgadmin 4Nov 13, 2025

  • CVE-2026-12046
    38Monitor

    pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution

    CriticalCVSS 9.5No exploitEPSS 1%

    pgadmin · pgadmin 4Jun 19, 2026

  • CVE-2026-17566
    37Monitor

    pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    pgadmin · pgadmin 4Jul 31, 2026

  • CVE-2026-12045
    37Monitor

    pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution

    CriticalCVSS 9.4No exploitEPSS 0%

    pgadmin · pgadmin 4Jun 19, 2026

  • CVE-2026-86863
    37Monitor

    pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode

    CriticalCVSS 9.3No exploitEPSS 0%

    pgadmin · pgadmin 4Sep 17, 2026

  • CVE-2026-17351
    37Monitor

    pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)

    CriticalCVSS 9.4No exploitEPSS 0%

    pgadmin · pgadmin 4Jul 31, 2026

  • CVE-2026-7813
    37Monitor

    pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode

    CriticalCVSS 9.4No exploitEPSS 0%

    pgadmin · pgadmin 4May 11, 2026

  • CVE-2026-17349
    37Monitor

    pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner

    CriticalCVSS 9.3No exploitEPSS 0%

    pgadmin · pgadmin 4Jul 31, 2026

  • CVE-2026-116241
    37Monitor

    pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier

    CriticalCVSS 9.4No exploitEPSS 0%

    pgadmin · pgadmin 4Oct 30, 2026

  • CVE-2026-12048
    37Monitor

    pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser

    CriticalCVSS 9.3No exploitEPSS 0%

    pgadmin · pgadmin 4Jun 19, 2026

  • CVE-2023-5002
    36Monitor

    Pgadmin4: remote code execution by an authenticated user

    HighCVSS 8.8No exploitEPSS 1%

    pgadmin · pgadmin 4Sep 22, 2023

  • CVE-2026-116238
    36Monitor

    pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks

    CriticalCVSS 9.2No exploitEPSS 0%

    pgadmin · pgadmin 4Oct 30, 2026

  • CVE-2025-13780
    35Monitor

    Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

    HighCVSS 8.8Proof of conceptEPSS 0%

    pgadmin · pgadmin 4Dec 11, 2025

  • CVE-2025-12763
    35Monitor

    Command injection vulnerability allowing arbitrary command execution on Windows

    HighCVSS 8.8No exploitEPSS 0%

    pgadmin · pgadmin 4Nov 13, 2025

  • CVE-2024-4215
    35Monitor

    The Multi Factor Authentication bypass vulnerability in pgAdmin 4

    HighCVSS 8.8No exploitEPSS 0%

    pgadmin · pgadmin 4May 2, 2024

  • CVE-2026-116239
    35Monitor

    pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username

    HighCVSS 8.9No exploitEPSS 0%

    pgadmin · pgadmin 4Oct 30, 2026

  • CVE-2026-7816
    34Monitor

    pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout

    HighCVSS 8.7No exploitEPSS 1%

    pgadmin · pgadmin 4May 11, 2026

  • CVE-2026-12044
    34Monitor

    pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates

    HighCVSS 8.7No exploitEPSS 0%

    pgadmin · pgadmin 4Jun 19, 2026

  • CVE-2026-17346
    34Monitor

    pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)

    HighCVSS 8.7No exploitEPSS 0%

    pgadmin · pgadmin 4Jul 31, 2026

  • CVE-2026-86864
    34Monitor

    pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool

    HighCVSS 8.7No exploitEPSS 0%

    pgadmin · pgadmin 4Sep 17, 2026

  • CVE-2026-7815
    34Monitor

    pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution

    HighCVSS 8.7No exploitEPSS 0%

    pgadmin · pgadmin 4May 11, 2026