agentprime: pgadmin-org-pgadmin-4Every new CVE for pgadmin-org-pgadmin-4.https://agentprime.io/CVE-2026-116252: pgAdmin 4: Materialized view refresh redirects its connection through a crafted database namehttps://agentprime.io/advisories/CVE-2026-116252/https://agentprime.io/advisories/CVE-2026-116252/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:20 GMTCVECVE-2026-116251: pgAdmin 4: A user's other sessions survive a change of their passwordhttps://agentprime.io/advisories/CVE-2026-116251/https://agentprime.io/advisories/CVE-2026-116251/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:19 GMTCVECVE-2026-116250: pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment checkhttps://agentprime.io/advisories/CVE-2026-116250/https://agentprime.io/advisories/CVE-2026-116250/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:18 GMTCVECVE-2026-116249: pgAdmin 4: Connection file paths and parameter keys escape the user's storage directoryhttps://agentprime.io/advisories/CVE-2026-116249/https://agentprime.io/advisories/CVE-2026-116249/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:18 GMTCVECVE-2026-116248: pgAdmin 4: Non-administrators can share a server with every userhttps://agentprime.io/advisories/CVE-2026-116248/https://agentprime.io/advisories/CVE-2026-116248/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:17 GMTCVECVE-2026-116247: pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificatehttps://agentprime.io/advisories/CVE-2026-116247/https://agentprime.io/advisories/CVE-2026-116247/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:16 GMTCVECVE-2026-116246: pgAdmin 4: Server passwords are left in pgAdmin's process environmenthttps://agentprime.io/advisories/CVE-2026-116246/https://agentprime.io/advisories/CVE-2026-116246/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:16 GMTCVECVE-2026-116245: pgAdmin 4: Connection services are not restricted in server modehttps://agentprime.io/advisories/CVE-2026-116245/https://agentprime.io/advisories/CVE-2026-116245/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:15 GMTCVECVE-2026-116244: pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentialshttps://agentprime.io/advisories/CVE-2026-116244/https://agentprime.io/advisories/CVE-2026-116244/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:15 GMTCVECVE-2026-116243: pgAdmin 4: Utility binary path can point at a shared storage directoryhttps://agentprime.io/advisories/CVE-2026-116243/https://agentprime.io/advisories/CVE-2026-116243/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:14 GMTCVECVE-2026-116242: pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identityhttps://agentprime.io/advisories/CVE-2026-116242/https://agentprime.io/advisories/CVE-2026-116242/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:13 GMTCVECVE-2026-116241: pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifierhttps://agentprime.io/advisories/CVE-2026-116241/https://agentprime.io/advisories/CVE-2026-116241/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:13 GMTCVEcriticalCVE-2026-116240: pgAdmin 4: File Manager and storage-path tools act on a different path from the one checkedhttps://agentprime.io/advisories/CVE-2026-116240/https://agentprime.io/advisories/CVE-2026-116240/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:12 GMTCVECVE-2026-116239: pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same usernamehttps://agentprime.io/advisories/CVE-2026-116239/https://agentprime.io/advisories/CVE-2026-116239/CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:12 GMTCVECVE-2026-116238: pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checkshttps://agentprime.io/advisories/CVE-2026-116238/https://agentprime.io/advisories/CVE-2026-116238/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:11 GMTCVEcriticalCVE-2026-86864: pgAdmin 4: Argument and connection-string injection via the database field in the Backup toolhttps://agentprime.io/advisories/CVE-2026-86864/https://agentprime.io/advisories/CVE-2026-86864/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Sep 2026 15:31:00 GMTCVECVE-2026-86863: pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication modehttps://agentprime.io/advisories/CVE-2026-86863/https://agentprime.io/advisories/CVE-2026-86863/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Sep 2026 15:30:58 GMTCVEcriticalCVE-2026-86862: pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance toolshttps://agentprime.io/advisories/CVE-2026-86862/https://agentprime.io/advisories/CVE-2026-86862/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Sep 2026 15:30:56 GMTCVECVE-2026-86861: pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment checkhttps://agentprime.io/advisories/CVE-2026-86861/https://agentprime.io/advisories/CVE-2026-86861/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Sep 2026 15:30:51 GMTCVECVE-2026-17566: pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)https://agentprime.io/advisories/CVE-2026-17566/https://agentprime.io/advisories/CVE-2026-17566/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 31 Jul 2026 16:00:22 GMTCVEcriticalCVE-2026-17351: pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)https://agentprime.io/advisories/CVE-2026-17351/https://agentprime.io/advisories/CVE-2026-17351/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 31 Jul 2026 16:00:19 GMTCVEcriticalCVE-2026-17350: pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlershttps://agentprime.io/advisories/CVE-2026-17350/https://agentprime.io/advisories/CVE-2026-17350/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 31 Jul 2026 16:00:03 GMTCVECVE-2026-17349: pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-ownerhttps://agentprime.io/advisories/CVE-2026-17349/https://agentprime.io/advisories/CVE-2026-17349/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 31 Jul 2026 15:59:47 GMTCVEcriticalCVE-2026-17348: pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046)https://agentprime.io/advisories/CVE-2026-17348/https://agentprime.io/advisories/CVE-2026-17348/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 31 Jul 2026 15:59:18 GMTCVECVE-2026-17347: pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitutionhttps://agentprime.io/advisories/CVE-2026-17347/https://agentprime.io/advisories/CVE-2026-17347/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 31 Jul 2026 15:59:16 GMTCVECVE-2026-17346: pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)https://agentprime.io/advisories/CVE-2026-17346/https://agentprime.io/advisories/CVE-2026-17346/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 31 Jul 2026 15:59:13 GMTCVECVE-2026-12049: pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameterhttps://agentprime.io/advisories/CVE-2026-12049/https://agentprime.io/advisories/CVE-2026-12049/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 18 Jun 2026 23:37:43 GMTCVECVE-2026-12048: pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parserhttps://agentprime.io/advisories/CVE-2026-12048/https://agentprime.io/advisories/CVE-2026-12048/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 18 Jun 2026 23:37:41 GMTCVEcriticalCVE-2026-12047: pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception texthttps://agentprime.io/advisories/CVE-2026-12047/https://agentprime.io/advisories/CVE-2026-12047/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 18 Jun 2026 23:37:39 GMTCVECVE-2026-12046: pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code executionhttps://agentprime.io/advisories/CVE-2026-12046/https://agentprime.io/advisories/CVE-2026-12046/CVSS 9.5 (Critical). Critical: CVSS score 9.5: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 18 Jun 2026 23:37:37 GMTCVEcriticalCVE-2026-12045: pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code executionhttps://agentprime.io/advisories/CVE-2026-12045/https://agentprime.io/advisories/CVE-2026-12045/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 18 Jun 2026 23:37:35 GMTCVEcriticalCVE-2026-12050: pgAdmin 4: SQL injection in named restore point endpointhttps://agentprime.io/advisories/CVE-2026-12050/https://agentprime.io/advisories/CVE-2026-12050/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 18 Jun 2026 23:37:19 GMTCVECVE-2026-12044: pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templateshttps://agentprime.io/advisories/CVE-2026-12044/https://agentprime.io/advisories/CVE-2026-12044/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 18 Jun 2026 23:37:16 GMTCVECVE-2024-6238: pgAdmin 4 Installation Directory permission issuehttps://agentprime.io/advisories/CVE-2024-6238/https://agentprime.io/advisories/CVE-2024-6238/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 25 Jun 2024 16:12:12 GMTCVE