CVE-2025-12764
BaseFortify
Publication date: 2025-11-13
Last updated on: 2025-11-19
Assigner: PostgreSQL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pgadmin | pgadmin_4 | to 9.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-90 | The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an LDAP injection in pgAdmin versions up to 9.9. It occurs in the LDAP authentication process, where an attacker can inject special LDAP characters into the username. This causes both the LDAP server and the client to process an unusually large amount of data, leading to a denial of service (DoS) condition.
How can this vulnerability impact me? :
The vulnerability can cause a denial of service (DoS) by making the LDAP server and client process an excessive amount of data. This can disrupt authentication services and potentially make the pgAdmin application unavailable to users.