{"id":"CVE-2025-2946","aliases":["EUVD-2025-9604","GHSA-2rrx-pphc-qfv9","PYSEC-2026-449","openSUSE-SU-2025:14983-1"],"status":"published","title":"Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4","description":"pgAdmin \u003c= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00329,"percentile":0.26214,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2025-04-03T12:23:30Z","modified":"2026-10-28T02:31:06Z","fixes":[{"ecosystem":"PyPI","package":"pgadmin4","fixed_in":["9.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2"}]}],"versions":["4.20","4.22","4.23","4.24","4.25","4.26","4.27","4.28","4.29","4.30","5.0","5.1","5.2","5.3","5.4","5.5","5.6","5.7","6.10","6.11","6.12","6.13","6.14","6.15","6.16","6.17","6.18","6.19","6.2","6.20","6.21","6.3","6.4","6.5","6.6","6.7","6.8","6.9","7.0","7.1","7.2","7.3","7.4","7.5","7.6","7.7","7.8","8.0","8.1","8.10","8.11","8.12","8.13","8.14","8.2","8.3","8.4","8.5","8.6","8.7","8.8","8.9","9.0","9.1"]},{"source":"osv","ecosystem":"PyPI","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2"}]}],"versions":["4.20","4.22","4.23","4.24","4.25","4.26","4.27","4.28","4.29","4.30","5.0","5.1","5.2","5.3","5.4","5.5","5.6","5.7","6.10","6.11","6.12","6.13","6.14","6.15","6.16","6.17","6.18","6.19","6.2","6.20","6.21","6.3","6.4","6.5","6.6","6.7","6.8","6.9","7.0","7.1","7.2","7.3","7.4","7.5","7.6","7.7","7.8","8.0","8.1","8.10","8.11","8.12","8.13","8.14","8.2","8.3","8.4","8.5","8.6","8.7","8.8","8.9","9.0","9.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2-1.1"}]}],"bundled":4}],"products":[{"vendor":"pgadmin","product":"pgadmin_4"},{"vendor":"pgadmin.org","product":"pgadmin 4"}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/8602","tags":["issue-tracking","Issue Tracking","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2946","tags":["advisory"]},{"url":"https://github.com/pgadmin-org/pgadmin4/commit/1305d9910beefd0d6b4c7eb4f111f86edb1d356b","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2rrx-pphc-qfv9","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2946.json","tags":["advisory"]},{"url":"https://github.com/pgadmin-org/pgadmin4","tags":["package"]},{"url":"https://pypi.org/project/pgadmin4","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BYON52PV4P44MGBG55FDOG2SP2G266ZO/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2946","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-2946","title":"Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4","description":"pgAdmin \u003c= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.","status":"published","published":"2025-04-03T12:23:30.694Z","modified":"2025-04-03T17:57:18.517Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:38.70481Z"}],"euvd":[{"id":"EUVD-2025-9604","description":"pgAdmin \u003c= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.","status":"published","published":"2025-04-03T12:23:30Z","modified":"2025-04-03T17:57:18Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:43.340305Z"}],"ghsa":[{"id":"GHSA-2rrx-pphc-qfv9","title":"pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering","description":"pgAdmin \u003c= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.","status":"published","published":"2025-04-03T15:31:13Z","modified":"2025-04-04T14:23:57Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:37.325334Z"}],"nvd":[{"id":"CVE-2025-2946","description":"pgAdmin \u003c= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.","status":"published","published":"2025-04-03T13:15:43.377Z","modified":"2026-06-17T09:07:53.99Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:58.094557Z"}],"osv":[{"id":"CVE-2025-2946","title":"Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4","description":"pgAdmin \u003c= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.","status":"published","published":"2025-04-03T12:23:30.694Z","modified":"2026-10-28T02:31:06.131731857Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"GHSA-2rrx-pphc-qfv9","title":"pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering","description":"pgAdmin \u003c= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.","status":"published","published":"2025-04-03T15:31:13Z","modified":"2026-06-29T12:26:25.241711978Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"PYSEC-2026-449","title":"pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering","description":"pgAdmin \u003c= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.","status":"published","published":"2026-06-29T11:50:35.932459Z","modified":"2026-07-01T20:22:59.859561Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"openSUSE-SU-2025:14983-1","title":"pgadmin4-9.2-1.1 on GA media","description":"These are all security issues fixed in the pgadmin4-9.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-10T00:00:00Z","modified":"2026-02-04T03:09:54.490239Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}