Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Chat2DB v0.3.5: Untrusted XML Data Can Execute Malicious Code

CVE-2024-55081 · published 1 year ago
Summary

Chat2DB has a weakness in its XML handling that could allow an attacker to run unauthorized code on your system if they send a specially crafted XML file. This could potentially lead to data theft, system damage, or other security breaches. Update Chat2DB to the latest version to fix this issue.

Original advisory text
An XML External Entity (XXE) injection vulnerability in the component /datagrip/upload of Chat2DB v0.3.5 allows attackers to execute arbitrary code via supplying a crafted XML input.
An XML External Entity (XXE) injection vulnerability in the component /datagrip/upload of Chat2DB v0.3.5 allows attackers to execute arbitrary code via supplying a crafted XML input.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-611XML External Entity (XXE)
Timeline
Published19 Dec 2024
Updated31 Oct 2026
First seen7 Mar 2026
Sources
CVE-2024-55081 · NVD
Track software like this
Free during beta