pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0015-1 advisory.

    - CVE-2025-12765: insufficient checks in the LDAP authentication flow allow a for bypass of TLS     certificate validation       that can lead to the stealing of bind credentials and the altering of directory responses (bsc#1253478).
    - CVE-2025-12764: improper validation of characters in a username allows for LDAP injections that force     the processing       of unusual amounts of data and leads to a DoS (bsc#1253477).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0016-1 advisory.

    - CVE-2025-12765: insufficient checks in the LDAP authentication flow allow a for bypass of TLS     certificate validation       that can lead to the stealing of bind credentials and the altering of directory responses (bsc#1253478).
    - CVE-2025-12764: improper validation of characters in a username allows for LDAP injections that force     the processing       of unusual amounts of data and leads to a DoS (bsc#1253477).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-8a81153971 advisory.

    Update to pgadmin-9.10


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-f7d8e75d34 advisory.

    Update to pgadmin-9.10

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of pgAdmin installed on the remote host is prior to 9.10. It is, therefore, affected by the following vulnerabilities:

  - pgAdmin versions prior to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when     running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers     to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the     integrity and security of the database management system and underlying data. (CVE-2025-12762)

  - pgAdmin versions prior to 9.10 is affected by an LDAP injection vulnerability in the LDAP authentication flow that     allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and     the client to process an unusual amount of data DOS. (CVE-2025-12764)

  - pgAdmin versions prior to 9.10 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing     TLS certificate verification. (CVE-2025-12765)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
281849	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : pgadmin4 (SUSE-SU-2026:0015-1)	Nessus	SuSE Local Security Checks	high
281847	SUSE SLED15 / SLES15 Security Update : pgadmin4 (SUSE-SU-2026:0016-1)	Nessus	SuSE Local Security Checks	high
277243	Fedora 43 : pgadmin4 (2025-8a81153971)	Nessus	Fedora Local Security Checks	critical
277230	Fedora 42 : pgadmin4 (2025-f7d8e75d34)	Nessus	Fedora Local Security Checks	critical
275843	pgAdmin < 9.10 Multiple Vulnerabilities	Nessus	Databases	critical

Detections

Analytics

CVE-2025-12765

high

Tenable Plugins

high

high

critical

critical

critical