Detections
Analytics
pgAdmin < 9.16 Stored XSS / Open Redirect
critical Nessus Plugin ID 322419
Language:
Synopsis
The pgAdmin instance installed on the remote host is affected by multiple vulnerabilities.Description
The version of pgAdmin installed on the remote host is prior to 9.16. It is, therefore, affected by multiple vulnerabilities:- Text returned by a PostgreSQL server, including error messages, quoted object names, and EXPLAIN fields, is passed verbatim through html-react-parser at every user-facing sink. An attacker who controls or compromises a PostgreSQL server the victim connects to can inject markup that executes JavaScript with full same-origin access to the victim's authenticated pgAdmin session. (CVE-2026-12048)
- The multi-factor authentication flow accepts a next query/form parameter without validating that it is a same-origin URL. A crafted link can redirect a victim who completes MFA off the pgAdmin origin, enabling credential-phishing follow-on attacks. (CVE-2026-12049)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade pgAdmin to version 9.16 or later.See Also
https://github.com/pgadmin-org/pgadmin4/issues/10028
Plugin Details
Severity: Critical
ID: 322419
File Name: pgadmin_CVE-2026-12048.nasl
Version: 1.3
Type: Local
Agent: windows, macosx, unix
Family: Databases
Published: 6/24/2026
Updated: 7/2/2026
Configuration: Enable thorough checks (optional)
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 94.18
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2026-12049
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Critical
Base Score: 9.3
Threat Score: 7.3
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
CVSS Score Source: CVE-2026-12048
Vulnerability Information
CPE: cpe:/a:postgresql:pgadmin_4
Required KB Items: installed_sw/PostgreSQL pgAdmin4
Exploit Ease: No known exploits are available
Patch Publication Date: 6/18/2026
Vulnerability Publication Date: 6/18/2026
Reference Information
CVE: CVE-2026-12048, CVE-2026-12049