PT-2026-39624 · Pgadmin 4+1 · Pgadmin 4+1

Fahar Abbas · Published 2026-04-21 · Updated 2026-05-26 · CVE-2026-7814

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.15

Description A stored cross-site scripting (XSS) issue exists in the Browser Tree and Explain Visualizer modules. User-controlled PostgreSQL object names, such as those for databases, schemas, tables, or columns, are assigned to DOM elements using innerHTML. This allows crafted object names containing HTML markup to execute attacker-supplied JavaScript in the browser of any user who navigates to or executes EXPLAIN over the malicious object.

Recommendations Update to version 9.15 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-09130

CVE-2026-7814

GHSA-6P2C-69CV-3FXQ

Affected Products

Pgadmin

Pgadmin 4

References · 12

• 🔥 https://github.com/pgadmin-org/pgadmin4/issues/9865 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7814.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7814 · Security Note
• https://osv.dev/vulnerability/GHSA-6p2c-69cv-3fxq · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-09130 · Security Note
• https://cve.org/CVERecord?idCVE-2026-7814 · Security Note
• https://osv.dev/vulnerability/CVE-2026-7814 · Vendor Advisory
• https://github.com/pgadmin-org/pgadmin4 · Note
• https://github.com/pgadmin-org/pgadmin4/pull/9865 · Vendor Advisory, Patch
• https://twitter.com/CVEnew/status/2053954471256895569 · Twitter Post
• https://t.me/cveNotify/164682 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2053905393932235207 · Twitter Post