CVE-2025-12762

CRITICAL

pgAdmin <9.9 - RCE

Title source: llm

Description

pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.

Exploits (1)

nomisec WORKING POC

by djayaGit · poc

https://github.com/djayaGit/Blackash-CVE-2025-12762

View Code ZIP pw:eip

References (1)

[Issue Tracking, Vendor Advisory] https://github.com/pgadmin-org/pgadmin4/issues/9320

Scores

CVSS v3 9.1

EPSS 0.0017

EPSS Percentile 38.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Details

CWE

CWE-94

Status published

Products (2)

pgadmin/pgadmin_4 < 9.10

pypi/pgadmin4 0 - 9.10PyPI

Published Nov 13, 2025

Tracked Since Feb 18, 2026