Report feedback

An authenticated remote attacker can execute arbitrary code on the host server when restoring a database from a backup file in plain format [2][3].

The vulnerability is present in product:

• pgAdmin 4; <9.10;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

More information:

• CVE-2025-12762 at cve.org, NVD
• CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 13. 11. 2025.

Due to a flaw in the LDAP authentication mechanism, an unauthenticated remote attacker can bypass TLS certificate verification [4][5].

The vulnerability is present in product:

• pgAdmin 4; <9.10;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

More information:

• CVE-2025-12765 at cve.org, NVD
• CWE-295: Improper Certificate Validation at cwe.mitre.org

The vulnerability was publicly disclosed 13. 11. 2025.

Within LDAP authentication, an unauthenticated remote attacker can insert special characters into the username field and, by submitting them, carry out a DoS attack [6][7].

The vulnerability is present in product:

• pgAdmin 4; <9.10;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2025-12764 at cve.org, NVD
• CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 13. 11. 2025.

On Windows systems, an authenticated remote attacker can, under certain conditions during backup or restore, execute arbitrary system commands [8].

The vulnerability is present in product:

• pgAdmin 4; <9.10;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

More information:

• CVE-2025-12763 at cve.org, NVD
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 13. 11. 2025.