pgAdmin 4 in server mode has a path validation flaw in its check_access_permission() function, leading to discrepancies between checked and used file paths. This allows users to potentially access, read, delete, or rename files outside their designated storage directories, including other users' files, by exploiting path handling inconsistencies. The issue affects versions before 9.19 and does not impact desktop mode.
An incorrect authorization vulnerability exists in the single-stage query engine of Apache Pinot versions through 1.5.1. When broker access control is enabled, the engine authorizes only the table named in the query's FROM clause, but not dimension tables referenced via the lookup() transform function. This allows an authenticated user authorized for at least one table to access columns and arbitrary rows from any dimension table without proper authorization or row-level security filters. The multi-stage query engine is not affected. The issue is fixed in Apache Pinot version 1.6.0.
WIT SynApps Runtime versions through 1.4.11 have a vulnerability involving hardcoded OAuth client credentials exposed in frontend JavaScript files. This exposure allows unauthenticated attackers to obtain static clientId and clientSecret values, enabling them to impersonate the application in the OAuth authentication flow at the /web/api/v1/auth/token endpoint. The vulnerability undermines the confidentiality of the OAuth client credentials but does not impact integrity or availability.
WIT SynApps Runtime versions through 1.4.11 have a pre-authentication reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Exploitation can lead to credential harvesting, manipulation of the login process, access to browser-visible data, and same-origin requests to internal controller endpoints, including origin-switching in Cloud RIA scenarios.
pgAdmin 4 in server mode has an authentication flaw where accounts are maintained per authentication source, allowing the same username to exist across different sources (e.g., internal, LDAP, Kerberos). The application incorrectly associates authenticated users with accounts based solely on username, without verifying the authentication source. This can lead to users being logged in as different accounts, including privileged internal accounts, if usernames overlap. The issue affects versions before 9.19 and requires valid LDAP or Kerberos credentials to exploit.
pgAdmin 4 in server mode before version 9.19 has a vulnerability that allows bypassing the lockout mechanism after multiple failed login attempts on internal accounts. This flaw permits an unauthenticated attacker to make unlimited password guesses against internal accounts, including administrators, due to improper handling of login attempts across different authentication views and case-insensitive username matching. Additional issues include improper password reset handling across accounts from different authentication sources and exposure of server configuration information to unauthorized users. The vulnerability does not affect desktop mode.
A PHP Object Injection vulnerability exists in Enable Media Replace versions up to and including 4.2.2. This vulnerability allows an attacker with low privileges to execute arbitrary code or cause a denial of service without user interaction.
Secret Server versions earlier than 12.3.1 have a vulnerability where the PIN or biometric check is not always validated when using a FIDO2-compliant device. This could allow unauthorized access under certain conditions.
pgAdmin 4 versions before 9.19 have a vulnerability in server mode SSH tunnel handling. The application used the sshtunnel library without restricting it to user-configured identity files, causing it to load unencrypted private keys and SSH configuration from the service account's ~/.ssh directory. This allowed any user to configure a tunnel using the service account's SSH keys and agent, potentially accessing hosts that accept those keys without their own credentials. The issue is fixed in version 9.19 by restricting tunnel authentication to only user-configured identity files or passwords, preventing fallback to the service account's SSH keys and configuration. Desktop mode remains unaffected.
WIT SynApps Runtime versions through 1.4.11 have a cross-origin request forgery (CSRF) vulnerability that allows attackers to manipulate the victim's browser to send discovery requests to attacker-controlled hosts during controller onboarding. This can be used to probe internal network resources and cross IT/OT segmentation boundaries via a legitimate application path.
A vulnerability in pgAdmin 4 before version 9.19 allows server passwords to be exposed to other users due to improper handling of environment variables. The server manager wrote passwords into pgAdmin's process environment variables (PGPASSWORD), which are shared across user requests and inherited by background processes. This flaw enables one user to connect using another user's saved password. The issue is fixed by isolating the password environment to only the specific process that requires it.
An unauthenticated Cross Site Scripting (XSS) vulnerability exists in All In One Login versions up to and including 2.4.1. This vulnerability allows an attacker to execute malicious scripts in the context of a user's browser without requiring authentication.
A vulnerability in pgAdmin 4 before version 9.19 allowed unintended use of a Kerberos service account's credentials for GSSAPI authentication. When a connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed the KRB5CCNAME environment variable, causing the Kerberos library to fall back to the default credential cache of the operating system account running pgAdmin. This allowed any user to connect as the service account's Kerberos principal regardless of the username provided. The issue also affected Windows SSPI and psql started with pgAdmin's environment. The fix involves isolating Kerberos credential environment variables per connection and requiring updated libpq 16 or later for proper authentication enforcement.
In Secret Server versions prior to 12.3.1, a vulnerability exists where a user under certain conditions could submit an unsigned JSON Web Token (JWT) and gain cloudadmin permissions. This flaw allows privilege escalation by bypassing proper token validation.
pgAdmin 4 versions before 9.19 contain a critical vulnerability in the Import/Export Data tool. The tool wraps user queries in a psql \copy (...) TO command and attempts to validate balanced parentheses to prevent command injection. However, it incorrectly handles backslashes inside double-quoted identifiers, allowing an attacker to bypass this check and inject a TO PROGRAM clause. This clause executes arbitrary commands on the pgAdmin host with the operating system privileges of the pgAdmin process. The vulnerability arises because the server setting standard_conforming_strings can be turned off by ordinary database roles, affecting how backslashes are interpreted, which pgAdmin does not reliably account for. This issue is a bypass of the previous fix for CVE-2026-17566.
An unauthenticated PHP Object Injection vulnerability exists in LeadSnap versions up to and including 1.25. This vulnerability allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.
A Missing Authorization vulnerability exists in Arraytics Booktics up to version 1.0.31. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions that impact data integrity. The vulnerability has a CVSS v3.1 base score of 5.3, indicating medium severity. No patch or remediation information is currently provided.
A missing authorization vulnerability exists in Liquid Web / StellarWP BookIt plugin versions up to 2.6.0.6. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 4.3.
A vulnerability identified as CVE-2026-54854 affects Profile Builder versions up to and including 4.0.5, allowing users with Contributor privileges to escalate their access rights. This flaw could lead to limited confidentiality, integrity, and availability impacts. The vulnerability has a medium severity rating with a CVSS score of 6.3.
A broken access control vulnerability exists in Booking and Rental Manager versions up to and including 2.8.2. This flaw allows subscribers with limited privileges to access resources or functions beyond their authorization. The vulnerability has a medium severity with a CVSS score of 6.5, indicating a network attack vector with low complexity and no user interaction required. Confidentiality impact is high, but integrity and availability are not affected.