CVE WatchJul 23, 2026

CVE-2026-47668

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote co

CVSS

10.0

Critical

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Jul 23, 2026 · Last modified: Jul 23, 2026 · CWE-20 · CWE-94 · CWE-1188

EPSS · 30d

Not enough EPSS history yet.

Technical description

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-659079.1 CRI

—

———In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible6h CVE-2026-659068.8 HIG

—

———In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible6h CVE-2026-648158.1 HIG

—

——0In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files7h CVE-2026-648037.8 HIG

—

——0In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK7h CVE-2026-648027.8 HIG

—

——0In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration7h CVE-2026-595439.9 CRI

—

——0Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.6h