PT-2025-12314 · Eosphoros Ai · Db-Gpt

Name of the Vulnerable Software and Affected Versions: eosphoros-ai/DB-GPT version latest Description: eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/update' endpoint. The application fails to properly filter the '' character,...

DB-GPT 安全漏洞

DB-GPT is an AWEL and agent-based AI native data application development framework open-sourced by eosphoros. A security vulnerability exists in DB-GPT that originates on Windows systems via the /v1/agent/hub/update endpoint that could lead to arbitrary file deletion...

PT-2025-12065 · Unknown · Binary-Husky/Gpt Academic

Name of the Vulnerable Software and Affected Versions: binary-husky/gpt academic version 3.83 Description: An open redirect issue exists, allowing attackers to exploit user-controlled input in the file parameter for malicious purposes, such as phishing, malware distribution, and credential theft...

PT-2025-12086 · Unknown · Gpt Academy

Name of the Vulnerable Software and Affected Versions: GPT Academy version 3.83 Description: GPT Academy version 3.83 is vulnerable to Cross-Site WebSocket Hijacking CSWSH. This vulnerability allows an attacker to hijack an existing WebSocket connection between the victim's browser and the server...

DB-GPT 安全漏洞

DB-GPT is an AWEL and agent-based AI native data application development framework open-sourced by eosphoros. A security vulnerability exists in DB-GPT version 0.6.0, which stems from an absolute path traversal vulnerability in the file upload endpoint, which allows an attacker to upload any file...

DB-GPT 安全漏洞

DB-GPT is an AWEL and agent-based AI native data application development framework open-sourced by eosphoros. A security vulnerability exists in DB-GPT version v0.6.0, which stems from an arbitrary file upload vulnerability in the web API POST /v1/personal/agent/upload, which allows an attacker t...

GPT Academic 安全漏洞

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a denial of service vulnerability that stems from the use of insecure regular expressions. An attacker could exploit this vulnerability to cause a regular...

DB-GPT 跨站请求伪造漏洞

DB-GPT is an AWEL and proxy-based AI native data application development framework open-sourced by eosphoros. A cross-site request forgery vulnerability exists in DB-GPT version 0.6.0, which stems from an overly loose configuration of CORSMiddleware used by the uvicorn app, which could lead to a...

PT-2025-12088 · Hotreload +2 · Hotreload +2

Name of the Vulnerable Software and Affected Versions: GPT Academic version 3.83 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability. It occurs through the HotReload plugin function, which calls the crazy utils.get files from everything API without proper...

GPT Academic Backlink Vulnerability

GPT Academic is an interface that provides pragmatic interactions for LLM large language models such as GPT/GLM. GPT Academic suffers from a back-linking vulnerability that stems from not properly handling soft links, which can be exploited by an attacker to cause arbitrary file reads...

CVE-2025-25185

GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for soft links. An attacker can create a malicious file as a soft link pointing to a target file, then package this soft link file into a tar.gz file and upload it...

CVE-2025-25185

GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for soft links. An attacker can create a malicious file as a soft link pointing to a target file, then package this soft link file into a tar.gz file and upload it...

CVE-2025-25185

CVE-2025-25185: GPT Academic exposes a back-linking vulnerability in 3.91 and earlier where soft links are not properly handled during tar.gz extraction. An attacker can create a malicious file as a soft link to a target server file, package it in a tar.gz, upload it, and on decompression the sof...

CVE-2025-25185 GPT Academic allows arbitary file read by tarfile uncompress within softlink

GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for soft links. An attacker can create a malicious file as a soft link pointing to a target file, then package this soft link file into a tar.gz file and upload it...

CVE-2025-25185 GPT Academic allows arbitary file read by tarfile uncompress within softlink

GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for soft links. An attacker can create a malicious file as a soft link pointing to a target file, then package this soft link file into a tar.gz file and upload it...

CVE-2025-25185 GPT Academic allows arbitary file read by tarfile uncompress within softlink

GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for soft links. An attacker can create a malicious file as a soft link pointing to a target file, then package this soft link file into a tar.gz file and upload it...

DocsGPT 安全漏洞

DocsGPT is a cutting edge open source solution from Arc53 Open Source. It simplifies the process of finding information in project documentation. A security vulnerability exists in DocsGPT versions 0.8.1 through 0.12.0 that stems from improper parsing of JSON data using the eval function. An...

CVE-2024-31224

GPT Academic provides interactive interfaces for large language models. A vulnerability was found in gptacademic versions 3.64 through 3.73. The server deserializes untrustworthy data from the client, which may risk remote code execution. Any device that exposes the GPT Academic service to the...

The vulnerability of the data loading function from the arxiv scientific article archive in the GPT Academic machine learning application allows a hacker to perform an SSRF attack.

The vulnerability of the data loading function in the arxiv scientific article application for machine learning GPT Academic is related to insufficient verification of incoming requests. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack remotely...

Regular expression Denial of Service - ReDoS

Description A Regular Expression Denial of Service ReDoS vulnerability was identified in the Transformers library, specifically in the file tokenizationgptneoxjapanese.py of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions...