CVE-2026-7814

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-7814
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7814.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-7814
Aliases
Related
Published
2026-05-11T14:35:49.411Z
Modified
2026-07-15T01:49:08.359200405Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer
Details

Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules.

User-controlled PostgreSQL object names (database, schema, table, column, etc.) were assigned to DOM elements via innerHTML, allowing crafted object names containing HTML markup to execute attacker-supplied JavaScript in the browser of any pgAdmin user who navigated to or executed EXPLAIN over the malicious object.

Fix replaces innerHTML with textContent.

This issue affects pgAdmin 4: before 9.15.

Database specific 
{
    "cna_assigner": "PostgreSQL",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7814.json"
}
References

Affected packages

Git / github.com/pgadmin-org/pgadmin4

Affected ranges

Type
GIT
Repo
https://github.com/pgadmin-org/pgadmin4
Events
Introduced
31be1ae02619ebd11402af2a3f53b62c8d0cafd3
Fixed
86a8b165abbefd62e78fd43edcd66c0d09649442
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*",
    "extracted_events": [
        {
            "introduced": "6.9"
        },
        {
            "fixed": "9.15"
        }
    ]
}

Affected versions

Other
REL-6_10
REL-6_11
REL-6_12
REL-6_13
REL-6_14
REL-6_15
REL-6_16
REL-6_17
REL-6_18
REL-6_19
REL-6_20
REL-6_21
REL-6_9
REL-7_0
REL-7_1
REL-7_2
REL-7_3
REL-7_4
REL-7_5
REL-7_6
REL-7_7
REL-7_8
REL-8_0
REL-8_1
REL-8_10
REL-8_11
REL-8_12
REL-8_13
REL-8_14
REL-8_2
REL-8_3
REL-8_4
REL-8_5
REL-8_6
REL-8_7
REL-8_8
REL-8_9
REL-9_0
REL-9_1
REL-9_10
REL-9_11
REL-9_12
REL-9_13
REL-9_14
REL-9_2
REL-9_3
REL-9_4
REL-9_5
REL-9_6
REL-9_7
REL-9_8
REL-9_9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7814.json"