CVE-2026-6216

DbGate SVG Icon String FontIcon.svelte cross site scripting

5.1 MediumFix available

CVE-2026-6216 is a medium vulnerability (CVSS 5.1) in dbgate-web, published April 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in dbgate-web 7.1.5.

What does this mean?

Severity: 5.1 MediumCVSS 4.0, CVE List
Exploit chance: 0.20%EPSS, 9th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 7.1.5dbgate-web

Description

A security vulnerability has been detected in DbGate up to 7.1.4. This affects an unknown function of the file packages/web/src/icons/FontIcon.svelte of the component SVG Icon String Handler. Such manipulation of the argument applicationIcon leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 7.1.5 mitigates this issue. It is advisable to upgrade the affected component.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Passive

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.20%Up 0.2 points since Apr 14, 2026

Affected packages

Affected packages
Package	Affected	Fixed
`dbgate-web` npm	before 7.1.5	7.1.5

What each source reports

CVE List Score used5.1

DbGate SVG Icon String FontIcon.svelte cross site scripting

Record: CVE-2026-6216
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 3.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
CVSS 3.0: 3.5 LowCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
CVSS 2.0: 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C
Weakness: CWE-79, CWE-94
Updated: 2026-11-02

EUVDEUVD-2026-220875.1

Record: EUVD-2026-22087
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Updated: 2026-11-02

GitHub AdvisoriesGHSA-j8j5-7r4h-vj2g2.0

DbGate has cross site scripting via the SVG Icon String Handler component

Record: GHSA-j8j5-7r4h-vj2g
CVSS 4.0: 2.0 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 3.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

NVD2.0

Record: CVE-2026-6216
CVSS 4.0: 2.0 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 3.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:N/I:P/A:N
Weakness: CWE-79, CWE-94
Updated: 2026-11-02

OSV2.0