CVE-2025-12765

HighCVSS 7.4/10Last modified Oct 7, 2026

Description

pgAdmin <= 9.9  is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published
Nov 13, 2025
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-127665.0An Insecure Direct Object Reference (IDOR) vulnerability in the Management Console of BlackBerry® AtHoc® (OnPrem) version 7.21 could allow aCVE-2025-127675.3IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression thatCVE-2025-127688.6A security issue exists within FactoryTalk® Historian Machine Edition. An attacker with low-level authentication could exploit this vulnerabCVE-2025-12777.8A maliciously crafted PDF file, when parsed through Autodesk applications, can force a Memory Corruption vulnerability. A malicious actor caCVE-2025-127705.3The New User Approve plugin for WordPress is vulnerable to unauthorized data disclosure in all versions up to, and including, 3.0.9 due to iCVE-2025-127717.8IBM Concert 1.0.0 through 2.1.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user could overfCVE-2025-127724.9Brocade SANnav before 2.4.0b logs the Brocade Fabric OS Switch admin password on the SANnav support save logs. When OOM occurs on a BrocadeCVE-2025-127736.5A vulnerability in update-reports-purge-settings.sh script logging for Brocade SANnav before 2.4.0a could allow the collection of SANnav datCVE-2025-127747.5A vulnerability in the migration script for Brocade SANnav before 3.0 could allow the collection of database sql queries in the SANnav suppoCVE-2025-127758.8The WP Dropzone plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 1.1.0 via thCVE-2025-127765.4The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerCVE-2025-127775.3The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.10.0. This
CVE-2025-12765: High severity, CVSS 7.4 | Vulnix