cve.bz

CVE-2026-34725

8.2 highEPSS 0.2%

High (8.2). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in dbgate-web 7.1.5.

DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in the Electron desktop app this can escalate to local code execution because Electron is configured with nodeIntegration: true and contextIsolation: false. This issue has been patched in version 7.1.5.

Severity

CVSS 3.1

8.2 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
EPSS
0.2% chance of exploitation in the next 30 days; higher than 6% of CVEs (scores of 2026-10-31)
CWEs
CWE-79, CWE-94
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-35xm-qvjg-8m42npmdbgate-web>=7.0.0 <7.1.57.1.5

References

Check your stackJSON