Approved changes feed: RSS · Atom
cpe:2.3:a:eosphoros-ai:db-gpt:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Eosphoros Ai (328ab5ae-050c-575d-a37d-f13851779d75) |
|---|---|
| Product | Db Gpt (bdbdc581-078d-579b-aedd-bc97bb79e861) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-4505 |
vulnerable | 2026-06-08 08:05:13.456992 |
eosphoros-ai DB-GPT FastAPI Endpoint controller.py module_plugin.refresh_plugins unrestricted upload
MEDIUM (6.3)
A vulnerability has been found in eosphoros-ai DB-GPT up to 0.7.5. This issue affects the function module_plugin.refresh_plugins of the file packages/dbgpt-serve/src/dbgpt_serve/agent/hub/controller.py of the component FastAPI Endpoint. Such manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-20T20:02:14.243Z
Updated: 2026-03-25T13:56:55.702Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4504 |
vulnerable | 2026-06-08 08:05:13.456575 |
eosphoros-ai db-gpt Incomplete Fix editor sql injection
HIGH (7.3)
A flaw has been found in eosphoros-ai db-gpt up to 0.7.5. This vulnerability affects unknown code of the file /api/v1/editor/ of the component Incomplete Fix. This manipulation causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-20T20:02:11.374Z
Updated: 2026-03-20T21:24:28.741Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3409 |
vulnerable | 2026-06-08 08:01:18.584541 |
eosphoros-ai db-gpt Flow Import Endpoint import importlib.machinery.SourceFileLoader.exec_module code injection
HIGH (7.3)
A security flaw has been discovered in eosphoros-ai db-gpt 0.7.5. Affected is the function importlib.machinery.SourceFileLoader.exec_module of the file /api/v1/serve/awel/flow/import of the component Flow Import Endpoint. Performing a manipulation as part of File results in code injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-02T04:02:08.022Z
Updated: 2026-03-02T15:05:26.398Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-6772 |
vulnerable | 2026-06-08 07:43:16.251437 |
eosphoros-ai db-gpt import import_flow path traversal
HIGH (7.3)
A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. Affected is the function import_flow of the file /api/v2/serve/awel/flow/import. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Published: 2025-06-27T18:31:05.585Z
Updated: 2025-06-27T19:06:42.576Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.