pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-49d6f62c0e advisory.

    Update to pgadmin-9.2.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of pgAdmin installed on the remote host is prior to 9.2. It is, therefore, affected by the following vulnerabilities:

  - Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The     vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the     query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely     passed to the Python eval() function, allowing arbitrary code execution. (CVE-2025-2945)

  - pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute     any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript     runs on the browser. (CVE-2025-2946)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers
    execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then
    HTML/JavaScript runs on the browser. (CVE-2025-2946)

ID	Name	Product	Family	Severity
234900	Fedora 41 : pgadmin4 (2025-49d6f62c0e)	Nessus	Fedora Local Security Checks	medium
234350	pgAdmin < 9.2 Multiple Vulnerabilities	Nessus	Databases	critical
424765	SCA: security update for pgadmin4 (GHSA-2rrx-pphc-qfv9)	Tenable Cloud Security	SCA Checks	medium
424765	SCA: security update for pgadmin4 (GHSA-2rrx-pphc-qfv9)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2025-2946

medium

Tenable Plugins

medium

critical

medium

medium