Vulnerabilidades de Pgadmin.org
CVEs publicadas que afetam produtos de Pgadmin.org: 30 registro(s), com severidade, exploração e correções.
CVE-2025-13780
Alta · 8.8
CWE-94 11/12/2025
Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)
pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.
CVE-2025-12765
Alta · 7.4
CWE-295 13/11/2025
pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass.
pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.
CVE-2025-12762
Crítica · 9.8
CWE-94 13/11/2025
Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)
pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.
CVE-2025-12764
Alta · 7.5
CWE-90 13/11/2025
pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.
pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.
CVE-2025-12763
Alta · 8.8
CWE-78 13/11/2025
Command injection vulnerability allowing arbitrary command execution on Windows
pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input.