pgAdmin Cross-site Scripting vulnerability in /settings/store API response json payload

Description

References

• nvd.nist.gov/vuln/detail/CVE-2024-4216 · ADVISORY
• pgadmin-org/pgadmin4 · WEB
• pgadmin-org/pgadmin4 commit e384c96 · WEB
• pgadmin-org/pgadmin4 · PACKAGE
• lists.fedoraproject.org/archives/list/[email protected]/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE · WEB
• lists.fedoraproject.org/archives/list/[email protected]/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE · Mailing List
• pypi.org/project/pgadmin4 · PACKAGE
• GitHub Advisory GHSA-xv64-8p4r-94gq · ADVISORY

Autres vulnérabilités de pgadmin4

• CVE-2026-7820MOYENNE 6.5Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4. pgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custo…
• CVE-2026-7819ÉLEVÉE 8.1Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager. check_access_permission used os.path.abspath, which resolves '..' …
• CVE-2026-7818ÉLEVÉE 7.8Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager. The session manager performed unsafe deserialization of …
• CVE-2026-7817MOYENNE 6.5Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints. User-suppli…
• CVE-2026-7816ÉLEVÉE 8.8OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export. User-supplied input was interpolated directly into a p…