postgresql pgadmin 4 vulnerabilities

Latest postgresql pgadmin 4 CVEs

Newest publication first

1. CVE-2024-9014 OAuth2 client id and secret exposed through the web browser in pgAdmin 4

   Published 2024-09-23

   Medium·CVSS 6.5

   pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

2. CVE-2024-3116 Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4

   Published 2024-04-04

   Critical·CVSS 9.8 EPSS 65.8% Framework module

   pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the...

3. CVE-2024-2044 Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4

   Published 2024-03-07

   Critical·CVSS 9.9 EPSS 79.5% Framework module

   pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.