CVE-2026-47668 DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner POST /runners/start allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically...

PT-2026-47063

Name of the Vulnerable Software and Affected Versions DbGate versions prior to 7.1.9 Description DbGate is subject to authenticated remote code execution. Users with valid credentials can execute arbitrary operating system commands as root by exploiting an unsanitized functionName parameter in th...

PT-2026-43683

Name of the Vulnerable Software and Affected Versions dbgate-serve versions prior to 7.1.9 Description An unauthenticated remote code execution issue exists in the database management tool. Attackers can achieve full system compromise without authentication or user interaction by injecting code...