Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-26 | 1 | PoC1 |
| 2026-05-27 | 1 | PoC1 |
| 2026-06-05 | 2 | Patch2 |
| 2026-06-08 | 1 | Patch1 |
| 2026-07-24 | 1 | Patch1 |
| 2026-07-30 | 1 | Disclosure1 |
| 2026-07-31 | 1 | Exploit1 |
CVE-2026-47668 — DbGate Remote Code Execution PoC: https://github.com/Nxploited/CVE-2026-47668 #CyberSecurity #InfoSec #EthicalHacking #Hacking #BugBounty #RedTeam #PenTesting
Post summary
A GitHub repository providing a proof‑of‑concept exploit for CVE‑2026‑47668, a Remote Code Execution vulnerability in DbGate, has been shared.
🧨 DbGate JSON Script Runner — Unauthenticated RCE with Public Exploit (CVSS 10.0) CVE-2026-47668 affects DbGate versions 7.1.8 and prior. The cross-platform database manager's JSON script runner endpoint (POST /runners/start) permits unauthenticated remote code…
Post summary
CVE-2026-47668 exposes an unauthenticated RCE in DbGate with a CVSS of 10.0; a public exploit exists but no patch or mitigation is discussed.
🔥 CRITICAL ALERT: Two CVSS 10.0 vulnerabilities disclosed! 🚨 Unauthenticated bypass in Azure HorizonDB (CVE-2026-48567) & RCE in DbGate (CVE-2026-47668) pose extreme risk to cloud environments. Patch and restrict access NOW! #CVE #RCE #CyberSecurity 🌐 cyber[.]netsecops[.]io https://t.co/nfPrjtoRA2
Post summary
The tweet alerts about two critical CVSS 10.0 vulnerabilities affecting Azure HorizonDB and DbGate, urging immediate patching and access restrictions.
🎯 Most likely to be exploited next (EPSS): • CVE-2026-6516 — EPSS 4.7% · CVSS 10 • CVE-2026-47668 — EPSS 4.3% · CVSS 10 • CVE-2026-17191 — EPSS 2.8% · CVSS 9.1 📄 Full weekly tables → https://github.com/notcve/reports/blob/main/weekly/2026-07-30.md
Post summary
The message lists three high‑CVSS CVEs with EPSS scores, offering a link to a weekly report but lacking details on PoC, exploitation, or patches.
Critical CVE-2026-47668 (CVSS 10.0) impacts DbGate 7.1.8 and earlier with remote code execution. Update promptly if using this database manager. https://nvd.nist.gov/vuln/detail/CVE-2026-47668 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/CtHLg32KYt
Post summary
The tweet announces a critical remote-code-execution vulnerability in DbGate 7.1.8 and earlier, encourages users to update promptly, but does not provide details of a PoC or active exploitation.
CVSS 10 unauthenticated RCE in DbGate. CVE-2026-47668 lets attackers inject code via the `functionName` param in JSON script commands — no auth, no interaction, full system compromise. Upgrade dbgate-serve to v7.1.9 now. https://secalerts.co/vulnerability/CVE-2026-47668 https://t.co/W80hOLlQt1
Post summary
The post announces a critical CVE‑2026‑47668 causing unauthenticated RCE in DbGate via the functionName parameter, and advises upgrading to v7.1.9 to apply the patch.
🚨 Multiple Critical Vulnerabilities Disclosed in DbGate Several severe vulnerabilities in DbGate can allow attackers to achieve remote code execution: • CVE-2026-47668 - Unauthenticated RCE via JSON Script Runner (dbgate-serve) • CVE-2026-47669 - Zip Slip arbitrary file write leading to RCE • CVE-2026-47670 - Authenticated RCE via functionName injection (dbgate-api) 👉 Affected: DbGate <= 7.1.8 ✅ Fix: Upgrade to 7.1.9 or later
Post summary
The post announces new critical vulnerabilities in DbGate, details the exploitation methods, and provides a patch recommendation to upgrade to version 7.1.9 or later.
Unauthenticated RCE on DbGate. PoC is live. CVE-2026-47668 - no login needed to execute code remotely on the database management tool trusted by devs and DBAs everywhere. Database tools are high-value, low-security targets. This one just got a lot worse. http://VulnTracker.io
Post summary
The post announces a live Proof of Concept for CVE-2026-47668, highlighting an unauthenticated remote code execution vulnerability in DbGate, but does not provide exploit code, patch information, or active exploitation reports.