CVE-2025-51458

all versions

SQL Injection in editor_sql_run and query_ex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary SQL stateme

6.5MEDIUM

CVE-2025-51459

all versions

File Upload vulnerability in agent.hub.controller.refresh_plugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute

6.5MEDIUM

CVE-2025-6772

<= 0.7.2

A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. Affected is the function import_

7.3HIGH

CVE-2025-0452

all versions

eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/update' endp

8.2HIGH

CVE-2024-10906

all versions

In version 0.6.0 of eosphoros-ai/db-gpt, the uvicorn app created by dbgpt_server uses an overly permissive instance of `CORSMi

8.1HIGH

CVE-2024-10902

all versions

In eosphoros-ai/db-gpt version v0.6.0, the web API POST /v1/personal/agent/upload is vulnerable to Arbitrary File Upload with Pa

9.8CRITICAL

CVE-2024-10901

all versions

In eosphoros-ai/db-gpt version v0.6.0, the web API POST /api/v1/editor/chart/run allows execution of arbitrary SQL queries witho

9.8CRITICAL

CVE-2024-10835

all versions

In eosphoros-ai/db-gpt version v0.6.0, the web API POST /api/v1/editor/sql/run allows execution of arbitrary SQL queries without

9.8CRITICAL

CVE-2024-10834

all versions

eosphoros-ai/db-gpt version 0.6.0 contains a vulnerability in the RAG-knowledge endpoint that allows for arbitrary file write. The

9.1CRITICAL

CVE-2024-10833

all versions

eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading f

9.1CRITICAL

CVE-2024-10831

all versions

In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerabilit

9.1CRITICAL

CVE-2024-10830

all versions

A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint /v1/resource/file/delete. Thi

8.2HIGH

CVE-2024-10829

all versions

A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of eosphoros-ai/db-gpt v0.6.0 allow

7.5HIGH