pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-2946 · ADVISORY
• pgadmin-org/pgadmin4 · WEB
• pgadmin-org/pgadmin4 commit 1305d99 · WEB
• pgadmin-org/pgadmin4 · PACKAGE
• pypi.org/project/pgadmin4 · PACKAGE
• GitHub Advisory GHSA-2rrx-pphc-qfv9 · ADVISORY

Weitere Schwachstellen in pgadmin4

• CVE-2026-7820MITTEL 6.5Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4. pgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custo…
• CVE-2026-7819HOCH 8.1Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager. check_access_permission used os.path.abspath, which resolves '..' …
• CVE-2026-7818HOCH 7.8Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager. The session manager performed unsafe deserialization of …
• CVE-2026-7817MITTEL 6.5Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints. User-suppli…
• CVE-2026-7816HOCH 8.8OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export. User-supplied input was interpolated directly into a p…