CVE· 2 min read
CVE-2025-51459: DB-GPT RCE in DB-GPT Plugin Upload System
Remote code execution vulnerability in DB-GPT’s plugin upload functionality through unsafe Python code execution.
Artemiy Malyshau
Resources
Research, guides and the root causes underneath
Vulnerability research, CVE write-ups and practical guides from the team building Gecko. Written for the engineers who have to fix the thing, not just triage it.
Latest articles
CVE· 2 min readCVE-2025-51462: Ragflow XSS in Dialog Configuration
Stored cross-site scripting vulnerability in Ragflow’s dialog configuration functionality allowing malicious HTML/JavaScript execution.
Artemiy Malyshau
CVE· 1 min readCVE-2025-51463: Aim Path Traversal in Server Backup Restoration
A path traversal vulnerability was found in AIM server. This vulnerability allows remote attackers to write arbitrary files on the server’s filesystem via a malicious tar file extraction.
Artemiy Malyshau
CVE· 2 min readCVE-2025-51472: SuperAGI RCE via Unsafe Eval in Template Config
Remote code execution vulnerability in SuperAGI through unsafe eval() usage in agent template configuration processing.
Artemiy Malyshau
CVE· 2 min readCVE-2025-51475: SuperAGI AFO in File Upload Endpoint
Arbitrary file overwrite vulnerability in SuperAGI’s file upload functionality due to insufficient path sanitization.
Artemiy Malyshau
Showing 43 - 47 of 47 articles
Stay connected with Gecko Security
Occasional updates and insights. No spam; unsubscribe anytime.