CVE-2025-2945General(pgadmin / pgadmin_4)

LOWCVSS 8.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Prioritize remediation for pgadmin pgadmin_4 systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution. This issue affects pgAdmin 4: before 9.2.

pgadmin CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/pgadmin-org/pgadmin4/issues/8603

Weakness type (CWE)

CWE-94

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

pgadmin_4

Threat summary

Public PoC and exploit tooling are both present
6 mentions across 5 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 2 signals
PoC mentioned or linked in 3 signals
Technical details provided in 3 signals
General: 3 classified signals
Peaked 2d ago at 2 mentions (2026-08-12); latest day: 1
6 total mentions across 5 days

Affected systems

Vendors

pgadmin

Products

pgadmin_4

Deep dive

Activity timeline6 mentions / 5d

Signal classification3 categories

General

350.0%

Exploit

233.3%

PoC

116.7%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-12	1	PoC1
2026-07-27	1	Exploit1
2026-08-12	2	Exploit1General1
2026-08-14	1	General1
2026-08-29	1	General1

Full discourse6 posts

Procter💻.@0xProcter58d
General
✅ Web enumeration + Gitea → credentials ✅ CVE-2025-2945 in pgAdmin → RCE ✅ SSH access as svc ✅ Pivoting via ligolo-ng ✅ NFS UID/GID Confusion → access to Docker certs ✅ Docker TLS impersonation → full host access (User Flag) ✅ PWM config tampering + LDAP redirection → AD credentials ✅ ESC7 → ESC6 → forged Administrator certificate ✅ DCSync → NTLM hash → Root Flag الة مُتعبه ، الحمدلله انها ما نزل بالسيزن 🤦🏾‍♂️
Post summary
The text outlines an exploitation chain that enumerated Gitea credentials, leveraged the RCE CVE‑2025‑2945 in pgAdmin, used SSH and pivot tools like ligolo‑ng, and performed privilege escalation via NFS confusion and Docker TLS impersonation to ultimately harvest host and AD credentials.
100145693
2.0K followersView on X
ExploitGrid@exploitgrid60d
Exploit
[EXPLOIT] EGE-GH-CveopHx [CRITICAL/PoC] Linked: CVE-2025-2945 CVE-2025-2945 🔗 https://exploitgrid.net/exploits/899a87a9-8060-4bf1-9ea1-6f4f4b849b88
Post summary
A publicly accessible PoC and exploit for CVE‑2025‑2945 is available via an exploitgrid link, but no evidence of active exploitation or patches is provided.
1000032
30 followersView on X
ExploitGrid@exploitgrid60d
General
🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: EGE-GH-M3jqXW0 ( CVE-2024-3094 ) EGE-EDB-iFhaDfa ( CVE-2026-48907 ) EGE-GH-Ixgxp3b ( CVE-2025-59528 ) EGE-GH-eHXL7QB ( CVE-2024-8672 ) EGE-GH-CveopHx ( CVE-2025-2945 ) ..🧵👇
Post summary
The post lists several newly disclosed CVEs but provides no additional details, code, or mitigations.
1000051
30 followersView on X
ExploitGrid@exploitgrid76d
Exploit
[EXPLOIT] EGE-GH-OtNzBNa [CRITICAL/PoC] cve-2025-2945-poc 🔗 https://exploitgrid.net/exploits/144dae82-0acb-4492-b8b1-8a0a7abf118a
Post summary
The entry announces a critical PoC for CVE‑2025‑2945 and supplies a direct link to an exploit available on ExploitGrid, indicating that functional exploit code has been released.
1000018
28 followersView on X
r0otk3r@r0otk3r91d
PoC
🚨 CVE-2025-2945: Critical 9.9 CVSS pgAdmin 4 Authenticated RCE Cybersecurity https://www.youtube.com/watch?v=JG2XJ-Tw0Vc #Infosec #AppSec #RCE #pgAdmin4 #PostgreSQL #CodeInjection #CVE20252945 #PoC #EthicalHacking #BugBounty #PatchNow https://t.co/euFbFueHNG
Post summary
The tweet highlights CVE‑2025‑2945 as a critical authenticated RCE in pgAdmin 4 and links to a YouTube video presumably showing a PoC, but it offers no exploit code, patch, or evidence of active exploitation.
0001055
43 followersView on X
Khashayar 🇨🇦@khashayar_nzk43d
General
Spent time digging into CVE-2025-2945 (CVSS 9.9) — an authenticated RCE in #pgAdmin 4's Query Tool via unsafe eval() on a boolean flag. Wrote up the root cause, exploitation logic, and detection guidance here: https://khashayarnazarkardeh.com #CVE #AppSec #RedTeam
Post summary
The post discloses CVE‑2025‑2945, highlights a high‑severity authenticated RCE in pgAdmin 4’s Query Tool, and references a write‑up with exploitation logic, but no PoC, patch, or active exploitation is indicated.
0000082
82 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	pgadmin	pgadmin_4	-	postgresql	-

Explore more

Back to dashboard pgadmin CVEs pgadmin_4 vulnerabilities

What researchers are saying

CVE-2025-2945

Procter💻.[verified]@0xProcterGeneral

The text outlines an exploitation chain that enumerated Gitea credentials, leveraged the RCE CVE‑2025‑2945 in pgAdmin, used SSH and pivot tools like ligolo‑ng, and performed privilege escalation via NFS confusion and Docker TLS impersonation to ultimately harvest host and AD credentials.

ExploitGrid@exploitgridExploit

A publicly accessible PoC and exploit for CVE‑2025‑2945 is available via an exploitgrid link, but no evidence of active exploitation or patches is provided.

ExploitGrid@exploitgridGeneral

The post lists several newly disclosed CVEs but provides no additional details, code, or mitigations.

ExploitGrid@exploitgridExploit

The entry announces a critical PoC for CVE‑2025‑2945 and supplies a direct link to an exploit available on ExploitGrid, indicating that functional exploit code has been released.

r0otk3r@r0otk3rPoC

The tweet highlights CVE‑2025‑2945 as a critical authenticated RCE in pgAdmin 4 and links to a YouTube video presumably showing a PoC, but it offers no exploit code, patch, or evidence of active exploitation.

Khashayar 🇨🇦@khashayar_nzkGeneral

The post discloses CVE‑2025‑2945, highlights a high‑severity authenticated RCE in pgAdmin 4’s Query Tool, and references a write‑up with exploitation logic, but no PoC, patch, or active exploitation is indicated.