pgAdmin <=9.1 XSS via Query Result Rendering
CVE-2025-2946 Published on April 3, 2025
Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4
pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.
Vulnerability Analysis
CVE-2025-2946 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2025-2946 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2025-2946
stack.watch emails you whenever new vulnerabilities are published in Pgadmin 4 or PostgreSQL pgAdmin. Just hit a watch button to start following.
Affected Versions
pgadmin.org pgAdmin 4:- Before 9.2 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.