Dbgate

9 CVEs in 1 Dbgate product, including Dbgate. Newest: CVE-2026-121455 (2026-11-03). Severity, EPSS and public exploits for each.

Dbgate products with known CVEs

ProductCVEs
Dbgate9
Dbgate CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-121455Medium5.42026-11-03DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGIN_PERMISSIONS because te…
CVE-2026-85176High8.82026-09-03DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resoluti…
CVE-2026-476702026-07-23DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate cre…
CVE-2026-476692026-07-23DbGate is cross-platform database manager. In versions 7.1.8 and prior, the `unzipDirectory()` function in `packages/api/src/shell/unzipDirectory.js` (line 27)…
CVE-2026-47668Critical10.02026-07-23DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via co…
CVE-2026-48017High8.82026-06-15DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that…
CVE-2026-34725High8.22026-04-02DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled…
CVE-2025-501852025-07-26DbGate is cross-platform database manager. In versions 6.6.0 and below, DbGate allows unauthorized file access due to insufficient validation of file paths and…
CVE-2025-501842025-07-26DbGate is cross-platform database manager. In versions 6.4.3-premium-beta.5 and below, DbGate is vulnerable to a directory traversal flaw. The file parameter i…