HIGH🇵🇱 Wersja polska

CVE-2023-1907

CVSS 8.0v3.1pub. 2025-01-09upd. 2025-06-20

A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

  • Pgadmin

    APP
    Pgadmin
    < 7.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-17566CRITICAL9.4PL ✓same vendor

pgAdmin 4: RCE przez command injection w narzędziu Import/Export Data

CVE-2026-17349CRITICAL9.3PL ✓same vendor

pgAdmin 4: kradzież poświadczeń przez nieuprawniony klon serwera (adhoc connect)

CVE-2026-17351CRITICAL9.4PL ✓same vendor

SQL injection bypass w pgAdmin 4 AI Assistant via sqlparse — obejście transakcji READ ONLY

CVE-2026-12046CRITICAL9.5PL ✓same vendor

pgAdmin 4: brak uwierzytelnienia na endpointach SQL Editor z deserialization RCE

CVE-2026-12045CRITICAL9.4PL ✓same vendor

pgAdmin 4 AI Assistant: ominięcie transakcji read-only i RCE via prompt injection