{"id":"CVE-2025-2946","published":"2025-04-03T12:23:30Z","modified":"2025-04-03T17:57:18Z","title":"Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query…","vendor":"pgadmin.org","product":"pgAdmin 4","tier":"tail","description":{"text":"pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00329,"percentile":0.25952,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/8602","tags":["issue-tracking"]}],"priority":{"score":11.6,"factors":[{"name":"EPSS percentile","points":5.19},{"name":"CVSS severity","points":6.37}]},"vendorSlug":"pgadmin-org","affectedVersions":[{"vendor":"pgadmin.org","product":"pgAdmin 4","versions":["< 9.2"]}],"affected":[{"ecosystem":"PyPI","package":"pgadmin4","vulnerableRanges":["<9.2"],"patched":["9.2"],"from":["GHSA-2rrx-pphc-qfv9","PYSEC-2026-449"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-9604","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-4215","published":"2024-05-02","fixed":"8.6","kev":false},{"cve":"CVE-2024-9014","published":"2024-09-23","fixed":"8.12","kev":false},{"cve":"CVE-2025-2945","published":"2025-04-03","fixed":"9.2","kev":false},{"cve":"CVE-2025-2946","published":"2025-04-03","fixed":"9.2","kev":false},{"cve":"CVE-2025-9636","published":"2025-09-04","fixed":"9.8","kev":false,"link":{"from":"CVE-2025-2946","to":"CVE-2025-9636","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:pgadmin4","fromFixed":"9.2","toFixed":"9.8","daysApart":154}]}},{"cve":"CVE-2025-12762","published":"2025-11-13","fixed":"9.10","kev":false},{"cve":"CVE-2025-12763","published":"2025-11-13","fixed":"9.10","kev":false}],"package":"PyPI:pgadmin4"}}