EUVD-2026-45212

Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/id endpoint. The handler calls dataSourceService.queryExistentid, ... without an ownership check and returns the decrypted password field, allowing any authenticated non-admin use...

EUVD-2024-52736

Malicious code in bioql PyPI...

CVE-2024-55081

An XML External Entity XXE injection vulnerability in the component /datagrip/upload of Chat2DB v0.3.5 allows attackers to execute arbitrary code via supplying a crafted XML input...

PT-2024-36471 · Chat2Db · Chat2Db

Name of the Vulnerable Software and Affected Versions: Chat2DB version 0.3.5 Description: A vulnerability in the /datagrip/upload component of Chat2DB allows attackers to execute arbitrary code via supplying a crafted XML input, exploiting an XML External Entity XXE injection flaw. Recommendation...

CVE-2024-55081

Chat2DB version v0.3.5 is affected by an XML External Entity (XXE) injection vulnerability in the /datagrip/upload component. An attacker can supply a crafted XML input to achieve arbitrary code execution . To mitigate this risk, it is recommended to disable the /datagrip/upload component and res...