Credential disclosure via database connection-string injection

Connection-string injection in pgAdmin 4 before 9.18 allows remote authenticated users to expose database passwords via Restore or Maintenance. These tools pass the client-supplied database field as --dbname to pg_restore or psql; libpq interprets values containing an equals sign as connection parameters, overriding the intended endpoint and sending the decrypted PGPASSWORD credential to an attacker-selected server. Exploitation requires a connected server and tools_restore or tools_maintenance permission, granted by the default User role; it also enables outbound connections to internal addresses but does not itself alter data or interrupt pgAdmin.