CVE-2026-4504

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4504", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-20T14:03:12.975Z", "datePublished": "2026-03-20T20:02:11.374Z", "dateUpdated": "2026-03-20T21:24:28.741Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-20T20:02:11.374Z"}, "title": "eosphoros-ai db-gpt Incomplete Fix editor sql injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "SQL Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "eosphoros-ai", "product": "db-gpt", "versions": [{"version": "0.7.0", "status": "affected"}, {"version": "0.7.1", "status": "affected"}, {"version": "0.7.2", "status": "affected"}, {"version": "0.7.3", "status": "affected"}, {"version": "0.7.4", "status": "affected"}, {"version": "0.7.5", "status": "affected"}], "modules": ["Incomplete Fix"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in eosphoros-ai db-gpt up to 0.7.5. This vulnerability affects unknown code of the file /api/v1/editor/ of the component Incomplete Fix. This manipulation causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-20T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-20T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-20T15:08:22.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Goku (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/?id.352070", "name": "VDB-352070 | eosphoros-ai db-gpt Incomplete Fix editor sql injection", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.352070", "name": "VDB-352070 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.773891", "name": "Submit #773891 | eosphoros-ai DB-GPT <=0.7.5 Remote command execution", "tags": ["third-party-advisory"]}, {"url": "https://huntr.com/bounties/e32fda74-ca83-431c-8de8-08274ba686c9", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-20T21:24:13.512867Z", "id": "CVE-2026-4504", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T21:24:28.741Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4504", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-20T21:24:13.512867Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T21:24:24.412Z"}}], "cna": {"title": "eosphoros-ai db-gpt Incomplete Fix editor sql injection", "credits": [{"lang": "en", "type": "reporter", "value": "Goku (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "eosphoros-ai", "modules": ["Incomplete Fix"], "product": "db-gpt", "versions": [{"status": "affected", "version": "0.7.0"}, {"status": "affected", "version": "0.7.1"}, {"status": "affected", "version": "0.7.2"}, {"status": "affected", "version": "0.7.3"}, {"status": "affected", "version": "0.7.4"}, {"status": "affected", "version": "0.7.5"}]}], "timeline": [{"lang": "en", "time": "2026-03-20T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-20T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-20T15:08:22.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.352070", "name": "VDB-352070 | eosphoros-ai db-gpt Incomplete Fix editor sql injection", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.352070", "name": "VDB-352070 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.773891", "name": "Submit #773891 | eosphoros-ai DB-GPT <=0.7.5 Remote command execution", "tags": ["third-party-advisory"]}, {"url": "https://huntr.com/bounties/e32fda74-ca83-431c-8de8-08274ba686c9", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in eosphoros-ai db-gpt up to 0.7.5. This vulnerability affects unknown code of the file /api/v1/editor/ of the component Incomplete Fix. This manipulation causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "SQL Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-20T20:02:11.374Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4504", "state": "PUBLISHED", "dateUpdated": "2026-03-20T21:24:28.741Z", "dateReserved": "2026-03-20T14:03:12.975Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-20T20:02:11.374Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Incomplete Fix"], "product": "db-gpt", "vendor": "eosphoros-ai", "versions": [{"status": "affected", "version": "0.7.0"}, {"status": "affected", "version": "0.7.1"}, {"status": "affected", "version": "0.7.2"}, {"status": "affected", "version": "0.7.3"}, {"status": "affected", "version": "0.7.4"}, {"status": "affected", "version": "0.7.5"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in eosphoros-ai db-gpt up to 0.7.5. This vulnerability affects unknown code of the file /api/v1/editor/ of the component Incomplete Fix. This manipulation causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha encontrado una falla en eosphoros-ai db-gpt hasta la versi\u00f3n 0.7.5. Esta vulnerabilidad afecta c\u00f3digo desconocido del archivo /api/v1/editor/ del componente Incomplete Fix. Esta manipulaci\u00f3n causa inyecci\u00f3n SQL. Es posible iniciar el ataque remotamente. El exploit ha sido publicado y puede ser utilizado. Se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-4504", "lastModified": "2026-06-17T10:56:43.063", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4504", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-20T21:24:13.512867Z", "version": "2.0.3"}}]}, "published": "2026-03-20T20:16:50.680", "references": [{"source": "cna@vuldb.com", "url": "https://huntr.com/bounties/e32fda74-ca83-431c-8de8-08274ba686c9"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.352070"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.352070"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.773891"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-89"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.7.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.7.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.7.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.7.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.7.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.7.5"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "db-gpt", "source": "cna", "vendor": "eosphoros-ai"}, "product": "db-gpt", "vendor": "eosphoros-ai"}], "analysis": {"en": {"generated_at": "2026-03-20T21:23:22.690735+00:00", "value": {"mitigation_remediation": ["Verify if a newer version of eosphoros\u2011ai db\u2011gpt has been released that addresses the SQL injection; if available, upgrade immediately.", "If no patch exists, restrict traffic to the /api/v1/editor/ endpoint by firewall rules or IP whitelisting to limit exposure to trusted hosts.", "Implement request sanitization or parameterized queries within the application to neutralize SQL injection attempts against the editor API.", "Monitor web server and database logs for anomalous query patterns or repeated injection attempts and investigate any suspicious activity."], "summary": {"action": "Patch If Possible", "impact": "SQL Injection Allowing Remote Database Access and Potential Code Execution (Medium\u2011High Severity)"}, "threat_synthesis": {"affected_systems": "The vulnerability affects eosphoros\u2011ai db\u2011gpt versions up to 0.7.5. No single revision beyond 0.7.5 is known to be impacted, and there is no information indicating that any earlier or later branches are remedied. The attack is confined to the exposed web API, so any deployment of the affected version that allows remote access to /api/v1/editor/ is susceptible.", "description_and_impact": "A flaw in the eosphoros\u2011ai db\u2011gpt component exposes the /api/v1/editor/ endpoint to SQL injection attacks. The vulnerability is exploitable from a remote attacker who can send crafted input that is interpreted directly by the database. Successful exploitation could allow the attacker to read, modify, or delete data in the database, and under certain conditions, may provide a foothold for further compromise or remote code execution. The CVSS score of 6.9 indicates that the impact is significant but does not guarantee full system takeover. The publicly available exploit demonstrates that the flaw is already in the wild and can be used without additional privileges.", "risk_and_exploitability": "The reported CVSS score of 6.9 reflects a medium\u2011high risk, and the EPSS score is not available. The vulnerability is not listed in CISA\u2019s KEV catalog, but an exploitation tool has already been published, suggesting that attackers may target vulnerable installations. The attack vector is remote, via HTTP requests to the editor API, and no privileged local execution is required. Given the absence of a vendor response and the lack of an available patch, the risk remains high until the affected component is removed or secured."}}}}, "created": "2026-03-23T09:52:50.609810+00:00", "updated": "2026-03-25T14:34:46.135055+00:00", "vendors": ["eosphoros-ai", "eosphoros-ai$PRODUCT$db-gpt"]}