Every CVE Search/ Get API key

CVE-2025-12764

pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.

7.5 HighFix available

pgAdmin <= 9.9  is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.48%Up 0.4 points since Nov 14, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.5

pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.

pgAdmin <= 9.9  is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.

Record
CVE-2025-12764
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-90
Updated
2026-11-02
EUVDEUVD-2025-169294 7.5

pgAdmin <= 9.9  is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.

Record
EUVD-2025-169294
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-cvf4-f829-762v 7.5

pgAdmin is affected by an LDAP injection vulnerability

pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.

Record
GHSA-cvf4-f829-762v
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-90
Updated
2026-11-02
NVD 7.5

pgAdmin <= 9.9  is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.

Record
CVE-2025-12764
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-90
Updated
2026-11-02
OSV 7.5

pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.

pgAdmin <= 9.9  is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.

Record
CVE-2025-12764
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-cvf4-f829-762v 7.5

pgAdmin is affected by an LDAP injection vulnerability

pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.

Record
GHSA-cvf4-f829-762v
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-90
Updated
2026-11-02
Show 4 moreShow less
OSVPYSEC-2026-1772 7.5

pgAdmin is affected by an LDAP injection vulnerability

pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.

Record
PYSEC-2026-1772
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2025:15818-1 No score

pgadmin4-9.11-1.1 on GA media

These are all security issues fixed in the pgadmin4-9.11-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15818-1
Updated
2026-11-02
OSVSUSE-SU-2026:0015-1 No score

Security update for pgadmin4

This update for pgadmin4 fixes the following issues:

  • CVE-2025-12765: insufficient checks in the LDAP authentication flow allow a for bypass of TLS certificate validation that can lead to the stealing of bind credentials and the altering of directory responses (bsc#1253478).
  • CVE-2025-12764: improper validation of characters in a username allows for LDAP injections that force the processing of unusual amounts of data and leads to a DoS (bsc#1253477).
Record
SUSE-SU-2026:0015-1
Updated
2026-11-02
OSVSUSE-SU-2026:0016-1 No score

Security update for pgadmin4

This update for pgadmin4 fixes the following issues:

  • CVE-2025-12765: insufficient checks in the LDAP authentication flow allow a for bypass of TLS certificate validation that can lead to the stealing of bind credentials and the altering of directory responses (bsc#1253478).
  • CVE-2025-12764: improper validation of characters in a username allows for LDAP injections that force the processing of unusual amounts of data and leads to a DoS (bsc#1253477).
Record
SUSE-SU-2026:0016-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pgadmin4
PyPI
 through 9.9
9.10
pgadmin4
PyPI
 before 9.10, plus listed versions
4.204.224.234.244.25
Show 45 moreShow less
4.264.274.284.294.305.05.15.25.35.45.55.65.76.106.116.126.136.146.156.166.176.186.196.26.206.216.36.46.56.66.76.86.97.07.17.27.37.47.57.67.77.88.08.18.10
9.10
pgadmin4
SUSE:Linux Enterprise Module for Python 3 15 SP7
From an advisory covering 2 CVEs
 before 8.5-150600.3.18.1
8.5-150600.3.18.1
pgadmin4
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 2 CVEs
 before 8.5-150600.3.18.1
8.5-150600.3.18.1
pgadmin4
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 2 CVEs
 before 8.5-150600.3.18.1
8.5-150600.3.18.1
pgadmin4
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 8.5-150600.3.18.1
8.5-150600.3.18.1
pgadmin4
SUSE:Linux Enterprise Module for Python 3 15 SP7
From an advisory covering 2 CVEs
 before 4.30-150300.3.21.1
4.30-150300.3.21.1
pgadmin4
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 2 CVEs
 before 4.30-150300.3.21.1
4.30-150300.3.21.1
pgadmin4
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 4.30-150300.3.21.1
4.30-150300.3.21.1
pgadmin4
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 2 CVEs
 before 4.30-150300.3.21.1
4.30-150300.3.21.1
Show 10 moreShow less
Affected packages
PackageAffectedFixed
pgadmin4
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 4.30-150300.3.21.1
4.30-150300.3.21.1
pgadmin4
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 4.30-150300.3.21.1
4.30-150300.3.21.1
pgadmin4
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 4.30-150300.3.21.1
4.30-150300.3.21.1
pgadmin4
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 2 CVEs
 before 4.30-150300.3.21.1
4.30-150300.3.21.1
pgadmin4
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 2 CVEs
 before 4.30-150300.3.21.1
4.30-150300.3.21.1
pgadmin4
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 2 CVEs
 before 4.30-150300.3.21.1
4.30-150300.3.21.1
pgadmin4
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 2 CVEs
 before 4.30-150300.3.21.1
4.30-150300.3.21.1
pgadmin4
SUSE:Manager Proxy LTS 4.3
From an advisory covering 2 CVEs
 before 4.30-150300.3.21.1
4.30-150300.3.21.1
pgadmin4
SUSE:Manager Server LTS 4.3
From an advisory covering 2 CVEs
 before 4.30-150300.3.21.1
4.30-150300.3.21.1
pgadmin4
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 9.11-1.1
9.11-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-12764 is a high vulnerability (CVSS 7.5) in Pgadmin 4, published November 13, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in pgadmin4 9.10.

References

Show 10 moreShow less
This page doesn't list everything

Left out here: 22 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open