CVE-2026-0949: Enterprisedb Postgres Enterprise Manager

Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days.

PEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows users with access to the Manage Charts menu to inject arbitrary JavaScript when creating a new chart, which is then executed by any user accessing the chart. By default only the superuser and users with pem_admin or pem_super_admin privileges are able to access the Manage Charts menu.

Affected products

• Enterprisedb Postgres Enterprise Manager: before 9.8.1 (fixed in 9.8.1)

Published 2026-01-16. Last modified 2026-06-17.