pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool

pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution

pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)

pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution

pgAdmin 4: SQL injection in named restore point endpoint

pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates

pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout

pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution

Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

Command injection vulnerability allowing arbitrary command execution on Windows

pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment

The Multi Factor Authentication bypass vulnerability in pgAdmin 4

A flaw was found in pgAdmin

The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore

pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write

Cross-Origin Opener Policy Vulnerability in pgAdmin 4

pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution

pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.

pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass.