CVE-2025-12764
Fixed in a distro release EPSS <1%CVSS 7.5
pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.
Products: pgadmin.org pgAdmin 4
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pgadmin4 | 9.10 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | pgadmin4 | 4.30-150300.3.21.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | pgadmin4 | 4.30-150300.3.21.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | pgadmin4 | 4.30-150300.3.21.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | pgadmin4 | 4.30-150300.3.21.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | pgadmin4 | 8.5-150600.3.18.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | pgadmin4 | 4.30-150300.3.21.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | pgadmin4 | 4.30-150300.3.21.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | pgadmin4 | 4.30-150300.3.21.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | pgadmin4 | 4.30-150300.3.21.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | pgadmin4 | 8.5-150600.3.18.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | pgadmin4 | 4.30-150300.3.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | pgadmin4 | 4.30-150300.3.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | pgadmin4 | 8.5-150600.3.18.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | pgadmin4 | 4.30-150300.3.21.1 |
| SUSE Manager Proxy LTS 4.3 | pgadmin4 | 4.30-150300.3.21.1 |
| SUSE Manager Server LTS 4.3 | pgadmin4 | 4.30-150300.3.21.1 |
| openSUSE Leap 15.6 | pgadmin4 | 8.5-150600.3.18.1 |
| openSUSE Tumbleweed | pgadmin4 | 9.11-1.1 |