diff --git a/advisories/unreviewed/2025/11/GHSA-w2p4-p4rh-qcm3/GHSA-w2p4-p4rh-qcm3.json b/advisories/unreviewed/2025/11/GHSA-w2p4-p4rh-qcm3/GHSA-w2p4-p4rh-qcm3.json index 579e7609f0741..bd0555f92008d 100644 --- a/advisories/unreviewed/2025/11/GHSA-w2p4-p4rh-qcm3/GHSA-w2p4-p4rh-qcm3.json +++ b/advisories/unreviewed/2025/11/GHSA-w2p4-p4rh-qcm3/GHSA-w2p4-p4rh-qcm3.json @@ -6,6 +6,7 @@ "aliases": [ "CVE-2025-12762" ], + "summary": "pgAdmin4 RCE vulnerability related to PLAIN-format dump restore in server mode", "details": "pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.", "severity": [ { @@ -13,7 +14,30 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pgadmin4" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "9.10" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 9.9" + } + } + ], "references": [ { "type": "ADVISORY",