Skip to content
OpenAdvisories

Vendor

Part-DB

13 known vulnerabilities.

Products

Part-DB-server 11 Part-DB 1 part-db/part-db 1
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 4.6
    CVE-2026-86020

    Part-DB: Spreadsheet Formula Injection in XLSX Part Exports

    Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts …

    Part-DB Part-DB-server
  • Medium 5.3
    CVE-2026-86019

    Part-DB: Attachment Size Limit Bypass via API Base64 Upload

    Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encode…

    Part-DB Part-DB-server
  • Medium 5.3
    CVE-2026-86018

    Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads

    Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment f…

    Part-DB Part-DB-server
  • Medium 5.4
    CVE-2026-59188

    Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer

    Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker…

    Part-DB Part-DB-server
  • Medium 5.7
    CVE-2026-55600

    Part-DB: Stored HTML injection in BOM validation results via unescaped Part name

    Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controll…

    Part-DB Part-DB-server
  • Medium 6.3
    CVE-2026-54631

    Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie

    Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP_SECRET (a03498528f5a5fc089273ec9ae5b2849). The official Docker image jbt…

    Part-DB Part-DB-server
  • Medium 6.0
    CVE-2026-54615

    Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)

    Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table (/log) and in element history tables. Every branch of LogEnt…

    Part-DB Part-DB-server
  • Medium 5.7
    CVE-2025-55194

    Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload

    Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension (e.g., .jpg.txt), resulting in a persistent 500 Internal Server Erro…

    Part-DB Part-DB-server
  • Medium 6.1
    CVE-2023-26042

    HTML/XSS injection possibilities in Part-DB

    Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and extern…

    Part-DB Part-DB-server