diff --git a/advisories/unreviewed/2025/04/GHSA-2rrx-pphc-qfv9/GHSA-2rrx-pphc-qfv9.json b/advisories/github-reviewed/2025/04/GHSA-2rrx-pphc-qfv9/GHSA-2rrx-pphc-qfv9.json similarity index 52% rename from advisories/unreviewed/2025/04/GHSA-2rrx-pphc-qfv9/GHSA-2rrx-pphc-qfv9.json rename to advisories/github-reviewed/2025/04/GHSA-2rrx-pphc-qfv9/GHSA-2rrx-pphc-qfv9.json index fe90ae5c0f9..772463cd9b6 100644 --- a/advisories/unreviewed/2025/04/GHSA-2rrx-pphc-qfv9/GHSA-2rrx-pphc-qfv9.json +++ b/advisories/github-reviewed/2025/04/GHSA-2rrx-pphc-qfv9/GHSA-2rrx-pphc-qfv9.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-2rrx-pphc-qfv9", - "modified": "2025-04-03T18:30:58Z", + "modified": "2025-04-04T14:23:54Z", "published": "2025-04-03T15:31:13Z", "aliases": [ "CVE-2025-2946" ], + "summary": "pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering", "details": "pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pgadmin4" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "9.2" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -22,6 +43,14 @@ { "type": "WEB", "url": "https://github.com/pgadmin-org/pgadmin4/issues/8602" + }, + { + "type": "WEB", + "url": "https://github.com/pgadmin-org/pgadmin4/commit/1305d9910beefd0d6b4c7eb4f111f86edb1d356b" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pgadmin-org/pgadmin4" } ], "database_specific": { @@ -29,8 +58,8 @@ "CWE-79" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-04T14:23:53Z", "nvd_published_at": "2025-04-03T13:15:43Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-g73c-fw68-pwx3/GHSA-g73c-fw68-pwx3.json b/advisories/github-reviewed/2025/04/GHSA-g73c-fw68-pwx3/GHSA-g73c-fw68-pwx3.json similarity index 58% rename from advisories/unreviewed/2025/04/GHSA-g73c-fw68-pwx3/GHSA-g73c-fw68-pwx3.json rename to advisories/github-reviewed/2025/04/GHSA-g73c-fw68-pwx3/GHSA-g73c-fw68-pwx3.json index b0d7b8224e2..955af7dddb1 100644 --- a/advisories/unreviewed/2025/04/GHSA-g73c-fw68-pwx3/GHSA-g73c-fw68-pwx3.json +++ b/advisories/github-reviewed/2025/04/GHSA-g73c-fw68-pwx3/GHSA-g73c-fw68-pwx3.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-g73c-fw68-pwx3", - "modified": "2025-04-03T18:30:58Z", + "modified": "2025-04-04T14:23:32Z", "published": "2025-04-03T15:31:13Z", "aliases": [ "CVE-2025-2945" ], + "summary": "pgAdmin 4 Vulnerable to Remote Code Execution", "details": "Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules).\n\nThe vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.\n\n\nThis issue affects pgAdmin 4: before 9.2.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pgadmin4" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "9.2" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -22,6 +43,14 @@ { "type": "WEB", "url": "https://github.com/pgadmin-org/pgadmin4/issues/8603" + }, + { + "type": "WEB", + "url": "https://github.com/pgadmin-org/pgadmin4/commit/75be0bc22d3d8d7620711835db817bd7c021007c" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pgadmin-org/pgadmin4" } ], "database_specific": { @@ -29,8 +58,8 @@ "CWE-94" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-04T14:23:31Z", "nvd_published_at": "2025-04-03T13:15:43Z" } } \ No newline at end of file