Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules. User-controlled PostgreSQL object names (database, schema, table, column, etc.) were assigned to DOM elements via innerHTML, allowing crafted object names containing HTML markup to execute attacker-supplied JavaScript in the browser of any pgAdmin user who navigated to or executed EXPLAIN over the malicious object. Fix replaces innerHTML with textContent. This issue affects pgAdmin 4: before 9.15.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-7814 Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules. User-controlled PostgreSQL object names (database, schema, ta… https://www.cve.org/CVERecord?id=CVE-2026-7814
Post summary
This post announces a stored XSS vulnerability (CVE‑2026‑7814) in pgAdmin 4’s Browser Tree and Explain Visualizer modules, linked to user‑controlled PostgreSQL object names.
CVE-2026-7814 Stored Cross-Site Scripting in pgAdmin 4 Browser Tree and Explain Visualizer Modules https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-7814
Post summary
The text announces a stored XSS vulnerability in pgAdmin 4's Browser Tree and Explain Visualizer Modules, providing the vulnerability type but no evidence of exploitation or mitigations.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pgadmin | pgadmin_4 | - | postgresql | - |