pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering

MEDIO 6.1CVE-2025-2946 · GHSA-2rrx-pphc-qfv9 · PYSEC-2026-449 · Published 03/04/2025 · updated 17/06/2026

In breve

CVE-2025-2946 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda pgadmin4, pgadmin 4 (pgadmin).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.33%, superiore al 26.1% delle vulnerabilità.
Correzione: aggiornare a 9.2 o successiva.

Package	Affected versions	Patched versions
pgadmin4 PyPI	`< 9.2`	`9.2`
pgadmin 4 pgadmin	`≤ 9.1`	No fix yet

Description

pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2025-2946 · ADVISORY
pgadmin-org/pgadmin4 · WEB
pgadmin-org/pgadmin4 commit 1305d99 · WEB
pgadmin-org/pgadmin4 · PACKAGE
pypi.org/project/pgadmin4 · PACKAGE
GitHub Advisory GHSA-2rrx-pphc-qfv9 · ADVISORY

Altre vulnerabilità di pgadmin4

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pgadmin4

PyPI

< 9.2

9.2

pgadmin 4

pgadmin

≤ 9.1

No fix yet

Description

NVD description

Altre vulnerabilità di pgadmin4

Vedi tutto →