CVE-2024-9014High· 8.6▾ MidnightPoC availableOAuth2 client ID and secret exposed through the web browser
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.3 · likelihood 1.9 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
9.7%
2 GitHub repos · Nuclei ×1
pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.
pgadmin4 < 8.12Upgrade to a patched release:
pgadmin4 8.12Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-4223High· 8.8pgadmin4 vulnerable to Code Injection
CVE-2024-3116High· 7.4pgAdmin Remote Code Execution (RCE) vulnerability
CVE-2026-7813Critical· 9.9pgAdmin 4 server mode has an authorization vulnerability affecting Server Groups, Servers, Shared Servers, Background Processes, and Debu…
CVE-2026-7817Medium· 6.5pgAdmin 4 contains local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities
CVE-2026-7816High· 8.8pgAdmin 4: OS command injection vulnerability in Import/Export query export
CVE-2026-7820Medium· 6.5pgAdmin 4: Improper restriction of excessive authentication attempts