CVE-2026-6216 | THREATINT

Description

A security vulnerability has been detected in DbGate up to 7.1.4. This affects an unknown function of the file packages/web/src/icons/FontIcon.svelte of the component SVG Icon String Handler. Such manipulation of the argument applicationIcon leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 7.1.5 mitigates this issue. It is advisable to upgrade the affected component.

PUBLISHED Reserved 2026-04-13 | Published 2026-04-13 | Updated 2026-04-13 | Assigner VulDB

MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

LOW: 3.5CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

LOW: 3.5CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

4.0AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C

Problem types

Cross Site Scripting

Code Injection

Timeline

2026-04-13:	Advisory disclosed
2026-04-13:	VulDB entry created
2026-04-13:	VulDB entry last update

Credits

ngocnn97 (VulDB User) reporter

References

vuldb.com/vuln/357135 (VDB-357135 | DbGate SVG Icon String FontIcon.svelte cross site scripting) vdb-entry technical-description

vuldb.com/vuln/357135/cti (VDB-357135 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/submit/785841 (Submit #785841 | DbGate DbGate Premium 7.1.4 Remote code execution via Stored XSS) third-party-advisory

github.com/dbgate/dbgate/releases/tag/v7.1.5 patch

github.com/dbgate/dbgate/ product

cve.org (CVE-2026-6216)

nvd.nist.gov (CVE-2026-6216)

Download JSON