pgadmin4 vulnerabilities (openSUSE)
50 vulnerabilities.
-
pgadmin4openSUSE pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780) 9.4 Critical -
pgadmin4openSUSE pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045) 9.4 Critical -
pgadmin4openSUSE pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers 5.3 Medium -
pgadmin4openSUSE pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner 9.3 Critical -
pgadmin4openSUSE pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution 7.7 High -
pgadmin4openSUSE pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameter 5.3 Medium -
pgadmin4openSUSE pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser 9.3 Critical -
pgadmin4openSUSE pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception text 4.8 Medium -
pgadmin4openSUSE pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution 9.5 Critical -
pgadmin4openSUSE pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution 9.4 Critical -
pgadmin4openSUSE pgAdmin 4: SQL injection in named restore point endpoint 5.3 Medium -
pgadmin4openSUSE pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates 8.7 High -
pgadmin4openSUSE pgAdmin 4: Account-lockout bypass via Flask-Security default /login view 6.9 Medium -
pgadmin4openSUSE pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write 7.2 High -
pgadmin4openSUSE pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution 7.3 High -
pgadmin4openSUSE pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpoints 7.1 High -
pgadmin4openSUSE pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout 8.7 High -
pgadmin4openSUSE pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution 8.7 High -
pgadmin4openSUSE pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer 4.8 Medium -
pgadmin4openSUSE pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode 9.4 Critical -
pgadmin4openSUSE Restore restriction bypass via key disclosure vulnerability (pgAdmin 4) 7.4 High -
pgadmin4openSUSE Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4) 9.1 Critical -
pgadmin4openSUSE pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass. 7.5 High -
pgadmin4openSUSE pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow. 7.5 High -
pgadmin4openSUSE Command injection vulnerability allowing arbitrary command execution on Windows 6.8 Medium -
pgadmin4openSUSE Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4) 9.1 Critical -
pgadmin4openSUSE Cross-Origin Opener Policy Vulnerability in pgAdmin 4 7.9 High -
pgadmin4openSUSE Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4 9.1 Critical -
pgadmin4openSUSE pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment 9.9 Critical -
pgadmin4openSUSE Possible SSRF and Credential Leakage via Absolute URL in axios Requests 7.7 High -
pgadmin4openSUSE Valid ECDSA signatures erroneously rejected in Elliptic 4.8 Medium -
pgadmin4openSUSE Elliptic's verify function omits uniqueness validation 9.1 Critical -
pgadmin4openSUSE OAuth2 client id and secret exposed through the web browser in pgAdmin 4 9.9 Critical -
pgadmin4openSUSE DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS) 6.4 Medium -
pgadmin4openSUSE Server-Side Request Forgery in axios 7.5 High -
pgadmin4openSUSE jrburke requirejs vulnerable to prototype pollution 10.0 Critical -
pgadmin4openSUSE jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function config.... 8.4 High -
pgadmin4openSUSE pgAdmin 4 Installation Directory permission issue 7.4 High -
pgadmin4openSUSE Unhandled 'error' event in socket.io 7.3 High -
pgadmin4openSUSE Memory Exhaustion in braces 7.5 High -
pgadmin4openSUSE Regular Expression Denial of Service in micromatch 5.3 Medium -
pgadmin4openSUSE XSS vulnerability in /settings/store API response json payload in pgAdmin 4 7.4 High -
pgadmin4openSUSE The Multi Factor Authentication bypass vulnerability in pgAdmin 4 7.4 High -
pgadmin4openSUSE Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4 7.4 High -
pgadmin4openSUSE Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4 9.9 Critical -
pgadmin4openSUSE Pgadmin4: remote code execution by an authenticated user 6.0 Medium -
pgadmin4openSUSE pgAdmin 4 vulnerable to directory traversal 6.5 Medium -
pgadmin4openSUSE pgAdmin 4 Open Redirect vulnerability 6.1 Medium -
pgadmin4openSUSE Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to... 9.8 Critical -
pgadmin4openSUSE pgAdmin 4 Path Traversal vulnerability 6.5 Medium