-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pgadmin4 | pip | <= 9.9 | 9.10 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability lies in the pgadmin.authenticate.ldap.LDAP.search_ldap_user function, where user-provided usernames were incorporated into an LDAP search filter without proper sanitization. The patch addresses this by introducing the escape_filter_chars function to neutralize special characters in the username before it's used in the filter. This prevents attackers from injecting malicious LDAP queries. The commit message explicitly mentions fixing an LDAP injection vulnerability (CVE-2025-12764), and the code change directly corresponds to the vulnerability description.
LDAP.search_ldap_userweb/pgadmin/authenticate/ldap.py
Ongoing coverage of React2Shell