CVE-2026-12047 : Detail

CVE-2026-12047

5.4
/
Sedang
2026-06-19
00h16 +00:00
Cross-site Scripting
A03-Injection
Network
2026-10-26
11h10 +00:00
CVE.org
NVD
Notifikasi untuk CVE tertentu
Tetap terinformasi tentang perubahan untuk CVE tertentu.
Kelola notifikasi

Deskripsi CVE

HTML injection in pgAdmin 4's cloud deployment module. The verify_credentials, deploy, regions, and update-server endpoints under /rds/, /azure/, /google/, and the top-level /cloud/ blueprint propagated AWS / Azure / Google SDK exception text — and the related file-resolution and database-commit exception text — into the JSON response body (the info and errormsg fields) without HTML-encoding. The Cloud Wizard frontend rendered these strings through html-react-parser, so an attacker-influenced exception message embedded structural HTML directly into the wizard's DOM. The reported entry point is /rds/verify_credentials/. An authenticated pgAdmin user submits a crafted access_key whose value contains an