Approved changes feed: RSS · Atom
cpe:2.3:a:dbgpt:db-gpt:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Dbgpt (0b6c949f-7c4d-59cd-9343-aaf5f7699f74) |
|---|---|
| Product | Db Gpt (9ad95ce4-b5d2-5081-bab4-6d4905ce2573) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-77933 |
vulnerable | 2026-11-03 10:15:17.781499 |
DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment
CRITICAL (9.8)
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.
Published: 2026-10-20T00:46:12.076Z
Updated: 2026-10-20T13:49:14.362Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-77932 |
vulnerable | 2026-11-03 10:15:17.330974 |
DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent
CRITICAL (9.8)
DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.
Published: 2026-10-20T00:46:11.410Z
Updated: 2026-10-20T13:49:48.138Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-6772 |
vulnerable | 2026-06-08 07:43:16.252614 |
eosphoros-ai db-gpt import import_flow path traversal
HIGH (7.3)
A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. Affected is the function import_flow of the file /api/v2/serve/awel/flow/import. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Published: 2025-06-27T18:31:05.585Z
Updated: 2025-06-27T19:06:42.576Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.