https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 23:12:06 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-15881 bdu:2025-15881 https://cve.radiocsirt.org/vuln/bdu:2025-15881 https://cve.radiocsirt.org/vuln/euvd-2026-271263 EUVD-2026-271263 https://cve.radiocsirt.org/vuln/euvd-2026-271263 https://cve.radiocsirt.org/vuln/fkie_cve-2025-13780 <p>pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.</p> <p>pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-13780 https://cve.radiocsirt.org/vuln/ghsa-fxmw-jcgr-w44v <p><strong>Affected:</strong> PyPI: pgadmin4</p> <p>The PLAIN restore meta-command filter introduced in pgAdmin as part of the fix for CVE-2025-12762 does not detect meta-commands when a SQL file begins with a UTF-8 Byte Order Mark (EF BB BF) or other special byte sequences. The implemented filter uses the function `has_meta_commands()`, which scans raw bytes using a regular expression. The regex does not treat the bytes as ignorable, so meta-commands such as `\\!` remain undetected. When pgAdmin invokes psql with --file, psql strips the bytes and executes the command. This can result in remote command execution during a restore operation.</p> <p><strong>Affected:</strong> PyPI: pgadmin4</p> <p>The PLAIN restore meta-command filter introduced in pgAdmin as part of the fix for CVE-2025-12762 does not detect meta-commands when a SQL file begins with a UTF-8 Byte Order Mark (EF BB BF) or other special byte sequences. The implemented filter uses the function `has_meta_commands()`, which scans raw bytes using a regular expression. The regex does not treat the bytes as ignorable, so meta-commands such as `\\!` remain undetected. When pgAdmin invokes psql with --file, psql strips the bytes and executes the command. This can result in remote command execution during a restore operation.</p> https://cve.radiocsirt.org/vuln/ghsa-fxmw-jcgr-w44v https://cve.radiocsirt.org/vuln/opensuse-su-2025:15818-1 <p>pgadmin4-9.11-1.1 on GA media</p> <p>pgadmin4-9.11-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15818-1 https://cve.radiocsirt.org/vuln/pysec-2026-450 <p><strong>Affected:</strong> PyPI: pgadmin4</p> <p>The PLAIN restore meta-command filter introduced in pgAdmin as part of the fix for CVE-2025-12762 does not detect meta-commands when a SQL file begins with a UTF-8 Byte Order Mark (EF BB BF) or other special byte sequences. The implemented filter uses the function `has_meta_commands()`, which scans raw bytes using a regular expression. The regex does not treat the bytes as ignorable, so meta-commands such as `\\!` remain undetected. When pgAdmin invokes psql with --file, psql strips the bytes and executes the command. This can result in remote command execution during a restore operation.</p> <p><strong>Affected:</strong> PyPI: pgadmin4</p> <p>The PLAIN restore meta-command filter introduced in pgAdmin as part of the fix for CVE-2025-12762 does not detect meta-commands when a SQL file begins with a UTF-8 Byte Order Mark (EF BB BF) or other special byte sequences. The implemented filter uses the function `has_meta_commands()`, which scans raw bytes using a regular expression. The regex does not treat the bytes as ignorable, so meta-commands such as `\\!` remain undetected. When pgAdmin invokes psql with --file, psql strips the bytes and executes the command. This can result in remote command execution during a restore operation.</p> https://cve.radiocsirt.org/vuln/pysec-2026-450 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2824 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in pgAdmin ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in pgAdmin ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2824