pgAdmin is a web-based administration and development platform for PostgreSQL databases that, despite a narrow product portfolio, occupies a prominent position in database-management tooling. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity and a strong tendency to acquire public exploit code, reflecting the platform's direct access to sensitive database infrastructure and its role in high-value operational environments. The exposure recurs across pgAdmin 4, pgAgent, and related tooling through weakness classes including code injection, cross-site scripting, OS command injection, and improper access control—patterns characteristic of web applications that bridge user input to backend services and database operations. Defenders should treat pgAdmin instances as security-critical and prioritize patching, especially those exposed to untrusted networks or handling privileged database credentials. Current exploitation status, severity breakdown, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Pgadmin over time
Signals from CVEs in this vendor scope (37 CVEs).
37 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-2044CRITICAL pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticat | Mar 7, 2024 | 9.9 | 82 | NO | YES |
CVE-2022-4223HIGH The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility | Dec 13, 2022 | 8.8 | 81 | NO | YES |
CVE-2024-3116CRITICAL pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on th | Apr 4, 2024 | 9.8 | 78 | NO | YES |
CVE-2025-2945HIGH Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules).
The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_t | Apr 3, 2025 | 8.8 | 67 | NO | YES |
CVE-2025-12762CRITICAL pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. | Nov 13, 2025 | 9.8 | 41 | NO | NO |
CVE-2026-12046CRITICAL Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connection/<sgid>/<sid>/<did> | Jun 19, 2026 | 9.0 | 39 | NO | NO |
CVE-2026-12045HIGH Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileg | Jun 19, 2026 | 8.8 | 38 | NO | NO |
CVE-2026-7813CRITICAL Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.
Multiple endpoints fetched user- | May 11, 2026 | 9.9 | 38 | NO | NO |
CVE-2026-12044HIGH SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS '<description>'`` for a user-supplied description field. The Jinja templates for Domains (a | Jun 19, 2026 | 8.8 | 37 | NO | NO |
CVE-2024-9014MEDIUM pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, | Sep 23, 2024 | 6.5 | 37 | NO | YES |
Signals from CVEs in this vendor scope (37 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Pgadmin.
Media articles that mention a CVE ID that affects a product developed by Pgadmin — matched by CVE ID, not by vendor name.