Vulnerability Database

314,433

Total vulnerabilities in the database

CVE-2025-12763

pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input.

  • Published: Nov 13, 2025
  • Updated: Nov 14, 2025
  • CVE: CVE-2025-12763
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 6.8
  • AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

CWEs:

OWASP TOP 10:

Software From Fixed in
pgadmin / pgadmin_4 - 9.10