CVE-2026-34725 dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration

DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in t...

CVE-2026-34725 dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration

DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in t...

DbGate 代码注入漏洞

DbGate is an open-source database manager developed by DbGate. Versions of DbGate from 7.0.0 to 7.1.5 had a code injection vulnerability. This vulnerability occurred because SVG icon strings controlled by attackers were rendered as raw HTML without being cleaned properly, which could lead to...

dbgate-serve (>=7.1.3-alpha.3, <=7.1.4), dbmodel (>=7.1.3-alpha.3, <=7.1.4) potentially affected by CVE-2026-34725 via dbgate-web (>=7.1.3-alpha.3, <=7.1.4-alpha.2)

dbgate-web NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.4 Source cves: CVE-2026-34725 Source advisory: OSV:GHSA-35XM-QVJG-8M42...

GHSA-8GC5-J5RX-235R vulnerabilities

Vulnerabilities for packages: langfuse-fips, renovate, tileserver-gl-fips, langfuse, dbgate, prism, tileserver-gl, jitsucom-jitsu, kubeflow-pipelines, kibana, dbgate-fips, librechat, saf...

CVE-2026-33036 vulnerabilities

Vulnerabilities for packages: langfuse-fips, renovate, tileserver-gl-fips, langfuse, dbgate, prism, tileserver-gl, jitsucom-jitsu, kubeflow-pipelines, kibana, dbgate-fips, librechat, saf...

GHSA-M7JM-9GC2-MPF2 vulnerabilities

Vulnerabilities for packages: langfuse-fips, renovate, tileserver-gl-fips, langfuse, dbgate, prism, tileserver-gl, kibana, dbgate-fips, saf...

CVE-2026-25896 vulnerabilities

Vulnerabilities for packages: langfuse-fips, renovate, tileserver-gl-fips, langfuse, dbgate, prism, tileserver-gl, kibana, dbgate-fips, saf...

GHSA-37QJ-FRW5-HHJH vulnerabilities

Vulnerabilities for packages: langfuse-fips, renovate, tileserver-gl-fips, langfuse, dbgate, prism, tileserver-gl, jitsucom-jitsu, kubeflow-pipelines, kibana, opensearch-dashboards-fips, opensearch-dashboards, dbgate-fips, librechat, saf...

CVE-2026-25128 vulnerabilities

Vulnerabilities for packages: langfuse-fips, renovate, tileserver-gl-fips, langfuse, dbgate, prism, tileserver-gl, jitsucom-jitsu, kubeflow-pipelines, kibana, opensearch-dashboards-fips, opensearch-dashboards, dbgate-fips, librechat, saf...

EUVD-2025-22773

Malicious code in bioql PyPI...

EUVD-2025-22767

Malicious code in bioql PyPI...

CVE-2025-50185

DbGate is cross-platform database manager. In versions 6.6.0 and below, DbGate allows unauthorized file access due to insufficient validation of file paths and types. A user with application-level access can retrieve data from arbitrary files on the system, regardless of their location or file...

CVE-2025-50184

DbGate is cross-platform database manager. In versions 6.4.3-premium-beta.5 and below, DbGate is vulnerable to a directory traversal flaw. The file parameter is not properly restricted to the intended uploads directory. As a result, the endpoint that lists files within the upload directory can be...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview dbgate-api is an Allows run DbGate data-manipulation scripts. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip via insufficient validation of file paths and types in the reader function. An attacker can access arbitrary files on the...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview dbgate-api is an Allows run DbGate data-manipulation scripts. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip via the file parameter in the /uploads/get endpoint. An attacker can access arbitrary files on the system by supplying a...

CVE-2025-50185

DbGate is cross-platform database manager. In versions 6.6.0 and below, DbGate allows unauthorized file access due to insufficient validation of file paths and types. A user with application-level access can retrieve data from arbitrary files on the system, regardless of their location or file...

CVE-2025-50184

DbGate is cross-platform database manager. In versions 6.4.3-premium-beta.5 and below, DbGate is vulnerable to a directory traversal flaw. The file parameter is not properly restricted to the intended uploads directory. As a result, the endpoint that lists files within the upload directory can be...

CVE-2025-50185 DbGate allows Unauthorized File Access via CSV Plugin

DbGate is cross-platform database manager. In versions 6.6.0 and below, DbGate allows unauthorized file access due to insufficient validation of file paths and types. A user with application-level access can retrieve data from arbitrary files on the system, regardless of their location or file...

CVE-2025-50185 DbGate allows Unauthorized File Access via CSV Plugin

DbGate is cross-platform database manager. In versions 6.6.0 and below, DbGate allows unauthorized file access due to insufficient validation of file paths and types. A user with application-level access can retrieve data from arbitrary files on the system, regardless of their location or file...