Back to Database
Status published
Critical
CVE-2025-2946
Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4
Vulnerability Description
pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-2946
Credits & Attribution
No credits recorded in the NVD database.
More from pgadmin.org
View All →CVE-2025-9636
Cross-Origin Opener Policy Vulnerability in pgAdmin 4
High
7.9
CVE-2025-2945
pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment
Critical
9.9
CVE-2025-13780
Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)
Critical
9.1
CVE-2025-12765
pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass.
High
7.5
CVE-2025-12764
pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.
High
7.5
Affected Vendor
pgadmin.org
View all reports →Affected Software
pgAdmin 4
Vulnerable Versions:
0
Timeline
Official Publish:
April 3rd, 2025
Last Modified:
April 3rd, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.