pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-8a81153971 advisory.

    Update to pgadmin-9.10


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-f7d8e75d34 advisory.

    Update to pgadmin-9.10

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of pgAdmin installed on the remote host is prior to 9.10. It is, therefore, affected by the following vulnerabilities:

  - pgAdmin versions prior to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when     running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers     to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the     integrity and security of the database management system and underlying data. (CVE-2025-12762)

  - pgAdmin versions prior to 9.10 is affected by an LDAP injection vulnerability in the LDAP authentication flow that     allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and     the client to process an unusual amount of data DOS. (CVE-2025-12764)

  - pgAdmin versions prior to 9.10 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing     TLS certificate verification. (CVE-2025-12765)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
277243	Fedora 43 : pgadmin4 (2025-8a81153971)	Nessus	Fedora Local Security Checks	critical
277230	Fedora 42 : pgadmin4 (2025-f7d8e75d34)	Nessus	Fedora Local Security Checks	critical
275843	pgAdmin < 9.10 Multiple Vulnerabilities	Nessus	Databases	critical

Detections

Analytics

CVE-2025-12762

critical

Tenable Plugins

critical

critical

critical