DbGate, a cross‑platform database manager, contains a stored cross‑site scripting flaw in its applicationIcon feature. Attackers can supply malicious SVG icon strings that are rendered as raw HTML. In the web interface this leads to script execution within any user’s browser, while in the Electron desktop application the vulnerable renderer configuration (nodeIntegration:true and contextIsolation:false) enables those scripts to access the underlying Node.js runtime, thereby raising the impact to local code execution.

DbGate versions from 7.0.0 up to, but not including, 7.1.5 are affected.

The vulnerability has a CVSS v3 score of 8.3, indicating high severity. EPSS data is not available and the issue is not catalogued in KEV, so the expected exploitation rate cannot be quantified from public data. The flaw can be abused through the web UI by any authenticated or unauthenticated user who can add an SVG icon, or via the desktop app by a local user who can supply a malicious icon. Because the Electron renderer has disabled isolation, the attack readily gains full access to the system the application runs on, making it a near‑certain vector once the precondition of a custom icon is met.