Approved changes feed: RSS · Atom
cpe:2.3:a:postgresql:pgadmin_4:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Postgresql (17ae1743-f0f5-50ae-b0e9-670248233cae) |
|---|---|
| Product | Pgadmin 4 (8ff2f5f2-eb7d-5c51-97f6-d97b95a07a7b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/dpage/pgadmin4 |
purl2cpe | 2026-06-01 10:12:17.573934 |
pkg:github/postgres/pgadmin4 |
purl2cpe | 2026-06-01 10:12:17.573937 |
pkg:rpm/fedora/pgadmin4 |
purl2cpe | 2026-06-01 10:12:17.573938 |
pkg:rpm/opensuse/pgadmin4 |
purl2cpe | 2026-06-01 10:12:17.573940 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-9014 |
vulnerable | 2026-06-08 07:00:26.472394 |
OAuth2 client id and secret exposed through the web browser in pgAdmin 4
CRITICAL (9.9)
pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.
Published: 2024-09-23T17:04:00.264Z
Updated: 2024-09-23T19:21:22.348Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3116 |
vulnerable | 2026-06-08 06:41:52.516127 |
Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4
HIGH (7.4)
pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.
Published: 2024-04-04T14:59:37.280Z
Updated: 2025-03-14T16:35:25.051Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2044 |
vulnerable | 2026-06-08 06:33:30.194159 |
Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4
CRITICAL (9.9)
pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution.
Published: 2024-03-07T20:48:10.066Z
Updated: 2025-02-13T17:32:31.782Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0241 |
vulnerable | 2026-06-08 05:52:04.584543 |
Details available
pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database.
Published: 2023-03-27T00:00:00.000Z
Updated: 2025-02-19T16:09:17.684Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0959 |
vulnerable | 2026-06-08 05:39:11.583898 |
Details available
A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write.
Published: 2022-03-16T14:03:38.000Z
Updated: 2024-08-02T23:47:42.970Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.