https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 12:03:50 +0000 https://cve.radiocsirt.org/vuln/cve-2026-12048 <p><strong>Affected:</strong> pgadmin.org pgAdmin 4</p> <p>Stored cross-site scripting in pgAdmin 4&#39;s error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, including object names quoted back inside relation-does-not-exist errors and inside EXPLAIN Recheck Cond / Exact Heap Blocks fields) was passed verbatim through html-react-parser at every user-facing sink — the notifier toasts, FormFooterMessage / FormInput help and error areas, FormNote, ModalProvider AlertContent and confirmDelete, ToolErrorView, the Explain visualiser&#39;s NodeText panel, the SQL editor confirm dialogs, ConfirmSaveContent, PreferencesHelper modal alerts, and SelectThemes helper text. A PostgreSQL server an attacker controls — or any server returning attacker-influenced text such as a table or column name a low-privilege database user can create — could inject arbitrary HTML (including &lt;iframe&gt;) into the pgAdmin DOM the moment the victim&#39;s pgAdmin connected to that server or viewed an Explain plan that referenced the crafted object.</p> <p>The injected iframe&#39;s srcdoc could fetch attacker-served JavaScript and, by writing to parent.location, redirect the victim&#39;s top-level pgAdmin browser tab to an attacker-controlled URL. Because the injection originates from inside pgAdmin&#39;s own interface, standard anti-clickjacking controls (X-Frame-Options, Content-Security-Policy: frame-ancestors) do not mitigate it. A phishing page rendered inside the legitimate pgAdmin window is indistinguishable from a genuine pgAdmin dialog…</p> <p><strong>Affected:</strong> pgadmin.org pgAdmin 4</p> <p>Stored cross-site scripting in pgAdmin 4&#39;s error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, including object names quoted back inside relation-does-not-exist errors and inside EXPLAIN Recheck Cond / Exact Heap Blocks fields) was passed verbatim through html-react-parser at every user-facing sink — the notifier toasts, FormFooterMessage / FormInput help and error areas, FormNote, ModalProvider AlertContent and confirmDelete, ToolErrorView, the Explain visualiser&#39;s NodeText panel, the SQL editor confirm dialogs, ConfirmSaveContent, PreferencesHelper modal alerts, and SelectThemes helper text. A PostgreSQL server an attacker controls — or any server returning attacker-influenced text such as a table or column name a low-privilege database user can create — could inject arbitrary HTML (including &lt;iframe&gt;) into the pgAdmin DOM the moment the victim&#39;s pgAdmin connected to that server or viewed an Explain plan that referenced the crafted object.</p> <p>The injected iframe&#39;s srcdoc could fetch attacker-served JavaScript and, by writing to parent.location, redirect the victim&#39;s top-level pgAdmin browser tab to an attacker-controlled URL. Because the injection originates from inside pgAdmin&#39;s own interface, standard anti-clickjacking controls (X-Frame-Options, Content-Security-Policy: frame-ancestors) do not mitigate it. A phishing page rendered inside the legitimate pgAdmin window is indistinguishable from a genuine pgAdmin dialog…</p> https://cve.radiocsirt.org/vuln/cve-2026-12048