CVE-2025-2946: pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering
pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.
Published Apr 3, 2025 · Updated Apr 4, 2025
Affected packages
pgadmin4
- Ecosystem
- PyPI
- Affected
- < 9.2
- Fixed in
- 9.2
- Check
pip show pgadmin4
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More PyPI vulnerabilities
All PyPI entriesCVE-2026-7813
pgAdmin 4 server mode has an authorization vulnerability affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules
critical9.9May 11, 2026CVE-2025-13780
pgadmin4 has a Meta-Command Filter Command Execution
critical9.1Dec 11, 2025CVE-2025-12762
pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode
critical9.1Nov 13, 2025CVE-2025-2945
pgAdmin 4 Vulnerable to Remote Code Execution
critical9.9Apr 3, 2025