CVE-2024-3116High· 7.4▾ MidnightPoC availablepgAdmin Remote Code Execution (RCE) vulnerability
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 40.7 · likelihood 13.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
65%
1 GitHub repo · Metasploit ×1
65% → 66%
pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.
pgadmin4 < 8.5Upgrade to a patched release:
pgadmin4 8.5Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-9014High· 8.6OAuth2 client ID and secret exposed through the web browser
CVE-2022-4223High· 8.8pgadmin4 vulnerable to Code Injection
CVE-2026-7813Critical· 9.9pgAdmin 4 server mode has an authorization vulnerability affecting Server Groups, Servers, Shared Servers, Background Processes, and Debu…
CVE-2026-7817Medium· 6.5pgAdmin 4 contains local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities
CVE-2026-7816High· 8.8pgAdmin 4: OS command injection vulnerability in Import/Export query export
CVE-2026-7820Medium· 6.5pgAdmin 4: Improper restriction of excessive authentication attempts