https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:09:02 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-09129 bdu:2026-09129 https://cve.radiocsirt.org/vuln/bdu:2026-09129 https://cve.radiocsirt.org/vuln/euvd-2026-309962 EUVD-2026-309962 https://cve.radiocsirt.org/vuln/euvd-2026-309962 https://cve.radiocsirt.org/vuln/fkie_cve-2026-7815 <p>SQL injection vulnerability in pgAdmin 4 Maintenance Tool.</p> <p>Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host.</p> <p>Fix introduces server-side allow-listing of all four fields and switches reindex_tablespace from manual quoting to the qtIdent filter.</p> <p>This issue affects pgAdmin 4: before 9.15.</p> <p>SQL injection vulnerability in pgAdmin 4 Maintenance Tool.</p> <p>Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host.</p> <p>Fix introduces server-side allow-listing of all four fields and switches reindex_tablespace from manual quoting to the qtIdent filter.</p> <p>This issue affects pgAdmin 4: before 9.15.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-7815 https://cve.radiocsirt.org/vuln/ghsa-hp84-p2gq-6fvr <p><strong>Affected:</strong> PyPI: pgadmin4</p> <p>SQL injection vulnerability in pgAdmin 4 Maintenance Tool.</p> <p>Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host.</p> <p>Fix introduces server-side allow-listing of all four fields and switches reindex_tablespace from manual quoting to the qtIdent filter.</p> <p>This issue affects pgAdmin 4: before 9.15.</p> <p><strong>Affected:</strong> PyPI: pgadmin4</p> <p>SQL injection vulnerability in pgAdmin 4 Maintenance Tool.</p> <p>Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host.</p> <p>Fix introduces server-side allow-listing of all four fields and switches reindex_tablespace from manual quoting to the qtIdent filter.</p> <p>This issue affects pgAdmin 4: before 9.15.</p> https://cve.radiocsirt.org/vuln/ghsa-hp84-p2gq-6fvr https://cve.radiocsirt.org/vuln/opensuse-su-2026:11508-1 <p>pgadmin4-9.17-1.1 on GA media</p> <p>pgadmin4-9.17-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11508-1 https://cve.radiocsirt.org/vuln/pysec-2026-2867 <p><strong>Affected:</strong> PyPI: pgadmin4</p> <p>SQL injection vulnerability in pgAdmin 4 Maintenance Tool.</p> <p>Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host.</p> <p>Fix introduces server-side allow-listing of all four fields and switches reindex_tablespace from manual quoting to the qtIdent filter.</p> <p>This issue affects pgAdmin 4: before 9.15.</p> <p><strong>Affected:</strong> PyPI: pgadmin4</p> <p>SQL injection vulnerability in pgAdmin 4 Maintenance Tool.</p> <p>Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host.</p> <p>Fix introduces server-side allow-listing of all four fields and switches reindex_tablespace from manual quoting to the qtIdent filter.</p> <p>This issue affects pgAdmin 4: before 9.15.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2867 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1462 <p>Ein Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, SQL-Injection- und Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, SQL-Injection- und Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1462