Part-DB

13 results · Feed

• High 8.7
  CVE-2026-86055

  Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover

  Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation…

  Part-DB Part-DB-server
  Oct 23, 2026
• Medium 4.6
  CVE-2026-86020

  Part-DB: Spreadsheet Formula Injection in XLSX Part Exports

  Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts …

  Part-DB Part-DB-server
  Oct 23, 2026
• Medium 5.3
  CVE-2026-86019

  Part-DB: Attachment Size Limit Bypass via API Base64 Upload

  Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encode…

  Part-DB Part-DB-server
  Oct 23, 2026
• Medium 5.3
  CVE-2026-86018

  Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads

  Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment f…

  Part-DB Part-DB-server
  Oct 23, 2026
• Medium 5.4
  CVE-2026-59188

  Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer

  Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker…

  Part-DB Part-DB-server
  Oct 23, 2026
• Medium 5.7
  CVE-2026-55600

  Part-DB: Stored HTML injection in BOM validation results via unescaped Part name

  Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controll…

  Part-DB Part-DB-server
  Oct 23, 2026
• Medium 6.3
  CVE-2026-54631

  Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie

  Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP_SECRET (a03498528f5a5fc089273ec9ae5b2849). The official Docker image jbt…

  Part-DB Part-DB-server
  Oct 23, 2026
• Critical 9.6
  CVE-2026-54630

  Part-DB: Authenticated RCE via .phar attachment upload served from public/media

  Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension…

  Part-DB Part-DB-server
  Oct 23, 2026
• Medium 6.0
  CVE-2026-54615

  Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)

  Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table (/log) and in element history tables. Every branch of LogEnt…

  Part-DB Part-DB-server
  Oct 23, 2026
• High 7.5
  CVE-2019-25432

  Part-DB 0.4 Authentication Bypass via login.php

  Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to login by injecting SQL syntax into authentication parameters. Attackers can submit a single quote followed by 'or' in the login form to bypass credential vali…

  Part-DB Part-DB
  Feb 20, 2026
• Medium 5.7
  CVE-2025-55194

  Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload

  Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension (e.g., .jpg.txt), resulting in a persistent 500 Internal Server Erro…

  Part-DB Part-DB-server
  Aug 13, 2025
• Medium 6.1
  CVE-2023-26042

  HTML/XSS injection possibilities in Part-DB

  Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and extern…

  Part-DB Part-DB-server
  Feb 27, 2023
• Critical 10.0
  CVE-2022-0848 Public exploit EPSS 35%

  OS Command Injection in part-db/part-db

  OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11.

  Part-DB part-db/part-db
  Mar 4, 2022