pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.
References
| Link | Resource |
|---|---|
| https://github.com/pgadmin-org/pgadmin4/issues/9325 | Issue Tracking Vendor Advisory |
Configurations
History
19 Nov 2025, 21:19
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Pgadmin
Pgadmin pgadmin 4 |
|
| References | () https://github.com/pgadmin-org/pgadmin4/issues/9325 - Issue Tracking, Vendor Advisory | |
| CPE | cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:* |
13 Nov 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-90 |
13 Nov 2025, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-13 13:15
Updated : 2025-11-19 21:19
NVD link : CVE-2025-12764
Mitre link : CVE-2025-12764
CVE.ORG link : CVE-2025-12764
JSON object : View
Products Affected
pgadmin
- pgadmin_4
CWE
CWE-90
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')