https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 11:08:23 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329100 EUVD-2026-329100 https://cve.radiocsirt.org/vuln/euvd-2026-329100 https://cve.radiocsirt.org/vuln/fkie_cve-2026-12050 <p>SQL injection in pgAdmin 4&#39;s named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-supplied &#39;value&#39; field was interpolated directly into the SQL string with str.format() instead of being passed as a bound parameter, allowing an authenticated pgAdmin user with a connected PostgreSQL session to inject additional statements through that endpoint.</p> <p>The injected SQL executes under the database role the user is already authenticated as. The defect does not cross a privilege boundary -- the user already has direct SQL access to that role through the Query Tool -- so the attacker gains no capability beyond what their database role already grants them. The marginal impact accounts for the fact that the injection path is not the documented SQL-execution interface, so a deployment that gates the Query Tool at the application layer could see SQL executed through a path it did not anticipate.</p> <p>Fix passes the restore point name as a bound parameter and schema-qualifies the function call as pg_catalog.pg_create_restore_point so a non-default search_path on the connection cannot redirect the call to a shadow definition. A regression test asserts the value arrives as a bound parameter and not spliced into the SQL string.</p> <p>This issue affects pgAdmin 4: from 1.0 before 9.16.</p> <p>SQL injection in pgAdmin 4&#39;s named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-supplied &#39;value&#39; field was interpolated directly into the SQL string with str.format() instead of being passed as a bound parameter, allowing an authenticated pgAdmin user with a connected PostgreSQL session to inject additional statements through that endpoint.</p> <p>The injected SQL executes under the database role the user is already authenticated as. The defect does not cross a privilege boundary -- the user already has direct SQL access to that role through the Query Tool -- so the attacker gains no capability beyond what their database role already grants them. The marginal impact accounts for the fact that the injection path is not the documented SQL-execution interface, so a deployment that gates the Query Tool at the application layer could see SQL executed through a path it did not anticipate.</p> <p>Fix passes the restore point name as a bound parameter and schema-qualifies the function call as pg_catalog.pg_create_restore_point so a non-default search_path on the connection cannot redirect the call to a shadow definition. A regression test asserts the value arrives as a bound parameter and not spliced into the SQL string.</p> <p>This issue affects pgAdmin 4: from 1.0 before 9.16.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-12050 https://cve.radiocsirt.org/vuln/ghsa-v395-x24j-4r3g <p>SQL injection in pgAdmin 4&#39;s named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-supplied &#39;value&#39; field was interpolated directly into the SQL string with str.format() instead of being passed as a bound parameter, allowing an authenticated pgAdmin user with a connected PostgreSQL session to inject additional statements through that endpoint.</p> <p>The injected SQL executes under the database role the user is already authenticated as. The defect does not cross a privilege boundary -- the user already has direct SQL access to that role through the Query Tool -- so the attacker gains no capability beyond what their database role already grants them. The marginal impact accounts for the fact that the injection path is not the documented SQL-execution interface, so a deployment that gates the Query Tool at the application layer could see SQL executed through a path it did not anticipate.</p> <p>Fix passes the restore point name as a bound parameter and schema-qualifies the function call as pg_catalog.pg_create_restore_point so a non-default search_path on the connection cannot redirect the call to a shadow definition. A regression test asserts the value arrives as a bound parameter and not spliced into the SQL string.</p> <p>This issue affects pgAdmin 4: from 1.0 before 9.16.</p> <p>SQL injection in pgAdmin 4&#39;s named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-supplied &#39;value&#39; field was interpolated directly into the SQL string with str.format() instead of being passed as a bound parameter, allowing an authenticated pgAdmin user with a connected PostgreSQL session to inject additional statements through that endpoint.</p> <p>The injected SQL executes under the database role the user is already authenticated as. The defect does not cross a privilege boundary -- the user already has direct SQL access to that role through the Query Tool -- so the attacker gains no capability beyond what their database role already grants them. The marginal impact accounts for the fact that the injection path is not the documented SQL-execution interface, so a deployment that gates the Query Tool at the application layer could see SQL executed through a path it did not anticipate.</p> <p>Fix passes the restore point name as a bound parameter and schema-qualifies the function call as pg_catalog.pg_create_restore_point so a non-default search_path on the connection cannot redirect the call to a shadow definition. A regression test asserts the value arrives as a bound parameter and not spliced into the SQL string.</p> <p>This issue affects pgAdmin 4: from 1.0 before 9.16.</p> https://cve.radiocsirt.org/vuln/ghsa-v395-x24j-4r3g https://cve.radiocsirt.org/vuln/opensuse-su-2026:11508-1 <p>pgadmin4-9.17-1.1 on GA media</p> <p>pgadmin4-9.17-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11508-1 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2005 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um beliebigen Code mit Benutzer- oder Administratorrechten auszuführen, Sicherheitsmaßnahmen zu umgehen, SQL-Injection- und Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um beliebigen Code mit Benutzer- oder Administratorrechten auszuführen, Sicherheitsmaßnahmen zu umgehen, SQL-Injection- und Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2005