https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 06:51:36 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-08904 bdu:2026-08904 https://cve.radiocsirt.org/vuln/bdu:2026-08904 https://cve.radiocsirt.org/vuln/euvd-2026-329102 EUVD-2026-329102 https://cve.radiocsirt.org/vuln/euvd-2026-329102 https://cve.radiocsirt.org/vuln/fkie_cve-2026-12048 <p>Stored cross-site scripting in pgAdmin 4&#39;s error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, including object names quoted back inside relation-does-not-exist errors and inside EXPLAIN Recheck Cond / Exact Heap Blocks fields) was passed verbatim through html-react-parser at every user-facing sink — the notifier toasts, FormFooterMessage / FormInput help and error areas, FormNote, ModalProvider AlertContent and confirmDelete, ToolErrorView, the Explain visualiser&#39;s NodeText panel, the SQL editor confirm dialogs, ConfirmSaveContent, PreferencesHelper modal alerts, and SelectThemes helper text. A PostgreSQL server an attacker controls — or any server returning attacker-influenced text such as a table or column name a low-privilege database user can create — could inject arbitrary HTML (including &lt;iframe&gt;) into the pgAdmin DOM the moment the victim&#39;s pgAdmin connected to that server or viewed an Explain plan that referenced the crafted object.</p> <p>The injected iframe&#39;s srcdoc could fetch attacker-served JavaScript and, by writing to parent.location, redirect the victim&#39;s top-level pgAdmin browser tab to an attacker-controlled URL. Because the injection originates from inside pgAdmin&#39;s own interface, standard anti-clickjacking controls (X-Frame-Options, Content-Security-Policy: frame-ancestors) do not mitigate it. A phishing page rendered inside the legitimate pgAdmin window is indistinguishable from a genuine pgAdmin dialog…</p> <p>Stored cross-site scripting in pgAdmin 4&#39;s error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, including object names quoted back inside relation-does-not-exist errors and inside EXPLAIN Recheck Cond / Exact Heap Blocks fields) was passed verbatim through html-react-parser at every user-facing sink — the notifier toasts, FormFooterMessage / FormInput help and error areas, FormNote, ModalProvider AlertContent and confirmDelete, ToolErrorView, the Explain visualiser&#39;s NodeText panel, the SQL editor confirm dialogs, ConfirmSaveContent, PreferencesHelper modal alerts, and SelectThemes helper text. A PostgreSQL server an attacker controls — or any server returning attacker-influenced text such as a table or column name a low-privilege database user can create — could inject arbitrary HTML (including &lt;iframe&gt;) into the pgAdmin DOM the moment the victim&#39;s pgAdmin connected to that server or viewed an Explain plan that referenced the crafted object.</p> <p>The injected iframe&#39;s srcdoc could fetch attacker-served JavaScript and, by writing to parent.location, redirect the victim&#39;s top-level pgAdmin browser tab to an attacker-controlled URL. Because the injection originates from inside pgAdmin&#39;s own interface, standard anti-clickjacking controls (X-Frame-Options, Content-Security-Policy: frame-ancestors) do not mitigate it. A phishing page rendered inside the legitimate pgAdmin window is indistinguishable from a genuine pgAdmin dialog…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-12048 https://cve.radiocsirt.org/vuln/ghsa-vmw6-74fq-69v8 <p>Stored cross-site scripting in pgAdmin 4&#39;s error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, including object names quoted back inside relation-does-not-exist errors and inside EXPLAIN Recheck Cond / Exact Heap Blocks fields) was passed verbatim through html-react-parser at every user-facing sink — the notifier toasts, FormFooterMessage / FormInput help and error areas, FormNote, ModalProvider AlertContent and confirmDelete, ToolErrorView, the Explain visualiser&#39;s NodeText panel, the SQL editor confirm dialogs, ConfirmSaveContent, PreferencesHelper modal alerts, and SelectThemes helper text. A PostgreSQL server an attacker controls — or any server returning attacker-influenced text such as a table or column name a low-privilege database user can create — could inject arbitrary HTML (including &lt;iframe&gt;) into the pgAdmin DOM the moment the victim&#39;s pgAdmin connected to that server or viewed an Explain plan that referenced the crafted object.</p> <p>The injected iframe&#39;s srcdoc could fetch attacker-served JavaScript and, by writing to parent.location, redirect the victim&#39;s top-level pgAdmin browser tab to an attacker-controlled URL. Because the injection originates from inside pgAdmin&#39;s own interface, standard anti-clickjacking controls (X-Frame-Options, Content-Security-Policy: frame-ancestors) do not mitigate it. A phishing page rendered inside the legitimate pgAdmin window is indistinguishable from a genuine pgAdmin dialog…</p> <p>Stored cross-site scripting in pgAdmin 4&#39;s error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, including object names quoted back inside relation-does-not-exist errors and inside EXPLAIN Recheck Cond / Exact Heap Blocks fields) was passed verbatim through html-react-parser at every user-facing sink — the notifier toasts, FormFooterMessage / FormInput help and error areas, FormNote, ModalProvider AlertContent and confirmDelete, ToolErrorView, the Explain visualiser&#39;s NodeText panel, the SQL editor confirm dialogs, ConfirmSaveContent, PreferencesHelper modal alerts, and SelectThemes helper text. A PostgreSQL server an attacker controls — or any server returning attacker-influenced text such as a table or column name a low-privilege database user can create — could inject arbitrary HTML (including &lt;iframe&gt;) into the pgAdmin DOM the moment the victim&#39;s pgAdmin connected to that server or viewed an Explain plan that referenced the crafted object.</p> <p>The injected iframe&#39;s srcdoc could fetch attacker-served JavaScript and, by writing to parent.location, redirect the victim&#39;s top-level pgAdmin browser tab to an attacker-controlled URL. Because the injection originates from inside pgAdmin&#39;s own interface, standard anti-clickjacking controls (X-Frame-Options, Content-Security-Policy: frame-ancestors) do not mitigate it. A phishing page rendered inside the legitimate pgAdmin window is indistinguishable from a genuine pgAdmin dialog…</p> https://cve.radiocsirt.org/vuln/ghsa-vmw6-74fq-69v8 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11508-1 <p>pgadmin4-9.17-1.1 on GA media</p> <p>pgadmin4-9.17-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11508-1 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2005 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um beliebigen Code mit Benutzer- oder Administratorrechten auszuführen, Sicherheitsmaßnahmen zu umgehen, SQL-Injection- und Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um beliebigen Code mit Benutzer- oder Administratorrechten auszuführen, Sicherheitsmaßnahmen zu umgehen, SQL-Injection- und Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2005