Db Gpt
Vendor:
First CVE: Mar 20, 2025 · Active for 1 year
13
Total CVEs
More Total CVEs than 92% of tracked products
13.0
Avg CVEs / Year
Higher CVE frequency than 97% of tracked products
8.4
Avg CVSS
Higher Avg CVSS than 76% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Db Gpt over time
Volume of CVEsAvg CVSS Base Score
First CVE
Mar 20, 2025
16 months ago
Most Recent CVE
Jul 22, 2025
371 days ago
CVE Severity & Scoring
Db Gpt13 CVEs
15%
38%
46%
All CVEs353,240 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network13 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low13 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None12 (92.3%)
Unknown0 (0.0%)
Required1 (7.7%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None13 (100.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-10833CRITICAL eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is susceptible to absolute pat | Mar 20, 2025 | 9.1 | 28 | NO | NO |
CVE-2024-10902CRITICAL In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthoriz | Mar 20, 2025 | 9.8 | 27 | NO | NO |
CVE-2024-10901CRITICAL In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/chart/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be e | Mar 20, 2025 | 9.8 | 26 | NO | NO |
CVE-2024-10835CRITICAL In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/sql/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be exp | Mar 20, 2025 | 9.8 | 26 | NO | NO |
CVE-2024-10831CRITICAL In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to upload arbitrary files to | Mar 20, 2025 | 9.1 | 25 | NO | NO |
CVE-2024-10834CRITICAL eosphoros-ai/db-gpt version 0.6.0 contains a vulnerability in the RAG-knowledge endpoint that allows for arbitrary file write. The issue arises from the ability to pass an absolute | Mar 20, 2025 | 9.1 | 24 | NO | NO |
CVE-2024-10830HIGH A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint `/v1/resource/file/delete`. This vulnerability allows an attacker to delete any f | Mar 20, 2025 | 8.2 | 23 | NO | NO |
CVE-2025-0452HIGH eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/update' endpoint. The application fails to properly filter the | Mar 20, 2025 | 8.2 | 22 | NO | NO |
CVE-2024-10906HIGH In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app created by `dbgpt_server` uses an overly permissive instance of `CORSMiddleware` which sets the `Access-Control-Allow-Ori | Mar 20, 2025 | 8.1 | 22 | NO | NO |
CVE-2025-6772HIGH A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. Affected is the function import_flow of the file /api/v2/serve/awel/flow/import. T | Jun 27, 2025 | 7.5 | 21 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (13 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (13 CVEs).
Media Mentions
Signals from CVEs in this product scope (13 CVEs).
Top CNAs Publishing CVEs For Db Gpt
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 0.7.0 | 2 | 6.5 | 0.3% | 0 | 0 |
| 0.6.1 | 1 | 8.2 | 0.5% | 0 | 0 |
| 0.6.0 | 9 | 8.9 | 0.8% | 0 | 0 |