GPT Academic 跨站请求伪造漏洞

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a cross-site request forgery vulnerability that stems from a WEB application that does not adequately verify that a request is from a trusted user. An attacke...

GPT Academic 安全漏洞

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. A server-side request forgery vulnerability exists in the GPT Academic crazyutils.getfilesfromeverything function, which can be exploited by an attacker to cause unauthorized access to...

DB-GPT 代码问题漏洞

DB-GPT is an AWEL and agent-based AI native data application development framework open-sourced by eosphoros. A code issue vulnerability exists in DB-GPT version v0.6.0, which stems from the web API POST /api/v1/editor/chart/run allows the execution of arbitrary SQL queries, which allows an...

PT-2025-12132 · Unknown +1 · Binary-Husky/Gpt Academic +1

Name of the Vulnerable Software and Affected Versions: binary-husky/gpt academic version git 310122f Description: A path traversal vulnerability exists in the application. The application extracts user-provided 7z files without proper validation. The Python py7zr package used for extraction does...

PT-2025-12086 · Unknown · Gpt Academy

Name of the Vulnerable Software and Affected Versions: GPT Academy version 3.83 Description: GPT Academy version 3.83 is vulnerable to Cross-Site WebSocket Hijacking CSWSH. This vulnerability allows an attacker to hijack an existing WebSocket connection between the victim's browser and the server...

PrivateGPT 跨站脚本漏洞

PrivateGPT is an AI project open-sourced by Zylon. A cross-site scripting vulnerability exists in PrivateGPT version v0.5.0, which stems from cross-site scripting during file uploads, which allows an attacker to upload a malicious SVG file and execute JavaScript when the victim clicks on the file...

GPT Academic 安全漏洞

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a path traversal vulnerability that can be exploited by an attacker to disclose sensitive information...

GPT Academic 安全漏洞

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a denial of service vulnerability that stems from the use of insecure regular expressions. An attacker could exploit this vulnerability to cause a regular...

DB-GPT 跨站请求伪造漏洞

DB-GPT is an AWEL and proxy-based AI native data application development framework open-sourced by eosphoros. A cross-site request forgery vulnerability exists in DB-GPT version 0.6.0, which stems from an overly loose configuration of CORSMiddleware used by the uvicorn app, which could lead to a...

DB-GPT 安全漏洞

DB-GPT is an AWEL and agent-based AI native data application development framework open-sourced by eosphoros. A security vulnerability exists in DB-GPT that originates on Windows systems via the /v1/agent/hub/update endpoint that could lead to arbitrary file deletion...

PT-2025-12314 · Eosphoros Ai · Db-Gpt

Name of the Vulnerable Software and Affected Versions: eosphoros-ai/DB-GPT version latest Description: eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/update' endpoint. The application fails to properly filter the '' character,...

PT-2025-12065 · Unknown · Binary-Husky/Gpt Academic

Name of the Vulnerable Software and Affected Versions: binary-husky/gpt academic version 3.83 Description: An open redirect issue exists, allowing attackers to exploit user-controlled input in the file parameter for malicious purposes, such as phishing, malware distribution, and credential theft...

DB-GPT 安全漏洞

DB-GPT is an AWEL and agent-based AI native data application development framework open-sourced by eosphoros. A security vulnerability exists in DB-GPT version 0.6.0, which stems from an absolute path traversal vulnerability in the file upload endpoint, which allows an attacker to upload any file...

DB-GPT 安全漏洞

DB-GPT is an AWEL and agent-based AI native data application development framework open-sourced by eosphoros. A security vulnerability exists in DB-GPT version v0.6.0, which stems from an arbitrary file upload vulnerability in the web API POST /v1/personal/agent/upload, which allows an attacker t...

PT-2025-12088 · Hotreload +2 · Hotreload +2

Name of the Vulnerable Software and Affected Versions: GPT Academic version 3.83 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability. It occurs through the HotReload plugin function, which calls the crazy utils.get files from everything API without proper...

GPT Academic Backlink Vulnerability

GPT Academic is an interface that provides pragmatic interactions for LLM large language models such as GPT/GLM. GPT Academic suffers from a back-linking vulnerability that stems from not properly handling soft links, which can be exploited by an attacker to cause arbitrary file reads...

CVE-2025-25185

GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for soft links. An attacker can create a malicious file as a soft link pointing to a target file, then package this soft link file into a tar.gz file and upload it...

CVE-2025-25185

GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for soft links. An attacker can create a malicious file as a soft link pointing to a target file, then package this soft link file into a tar.gz file and upload it...

CVE-2025-25185

CVE-2025-25185: GPT Academic exposes a back-linking vulnerability in 3.91 and earlier where soft links are not properly handled during tar.gz extraction. An attacker can create a malicious file as a soft link to a target server file, package it in a tar.gz, upload it, and on decompression the sof...

CVE-2025-25185 GPT Academic allows arbitary file read by tarfile uncompress within softlink

GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for soft links. An attacker can create a malicious file as a soft link pointing to a target file, then package this soft link file into a tar.gz file and upload it...