Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
26 vulnerabilities by Part-DB
CVE-2026-86055 (GCVE-0-2026-86055)
Vulnerability from nvd – Published: 2026-10-23 04:09 – Updated: 2026-10-29 12:56
VLAI
EPSS
VEX
Title
Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who submits a forgot-password request for a known account while sending a spoofed Host header causes Part-DB to email that account a reset link whose hostname is attacker-controlled, while still embedding the genuine reset token. When the victim opens the link (or an automated inbound mail-security scanner dereferences it), the valid token is disclosed to the attacker, who replays it against the real instance to set a new password and take over the account. Because the seeded admin account can be targeted, this yields full pre-authentication administrative account takeover. This issue has been patched in version 2.13.3.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 12:52 UTC
CWE
- CWE-640 - Weak Password Recovery Mechanism for Forgotten Password
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 2.13.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86055",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T12:52:45.808126Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T12:56:48.256Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-m9rf-69wp-c56r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 2.13.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who submits a forgot-password request for a known account while sending a spoofed Host header causes Part-DB to email that account a reset link whose hostname is attacker-controlled, while still embedding the genuine reset token. When the victim opens the link (or an automated inbound mail-security scanner dereferences it), the valid token is disclosed to the attacker, who replays it against the real instance to set a new password and take over the account. Because the seeded admin account can be targeted, this yields full pre-authentication administrative account takeover. This issue has been patched in version 2.13.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T04:09:27.051Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-m9rf-69wp-c56r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-m9rf-69wp-c56r"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.3"
}
],
"source": {
"advisory": "GHSA-m9rf-69wp-c56r",
"discovery": "UNKNOWN"
},
"title": "Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-86055",
"datePublished": "2026-10-23T04:09:27.051Z",
"dateReserved": "2026-09-04T19:29:21.059Z",
"dateUpdated": "2026-10-29T12:56:48.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86020 (GCVE-0-2026-86020)
Vulnerability from nvd – Published: 2026-10-23 04:05 – Updated: 2026-10-23 14:59
VLAI
EPSS
VEX
Title
Part-DB: Spreadsheet Formula Injection in XLSX Part Exports
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.
Severity
4.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 14:48 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 2.13.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86020",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T14:48:41.603210Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T14:59:59.159Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 2.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet\u0027s setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "CWE-1236: Improper Neutralization of Formula Elements in a CSV File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T04:05:24.420Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-hxw4-frfg-f8jw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-hxw4-frfg-f8jw"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.2"
}
],
"source": {
"advisory": "GHSA-hxw4-frfg-f8jw",
"discovery": "UNKNOWN"
},
"title": "Part-DB: Spreadsheet Formula Injection in XLSX Part Exports"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-86020",
"datePublished": "2026-10-23T04:05:24.420Z",
"dateReserved": "2026-09-04T19:23:40.691Z",
"dateUpdated": "2026-10-23T14:59:59.159Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86019 (GCVE-0-2026-86019)
Vulnerability from nvd – Published: 2026-10-23 04:04 – Updated: 2026-10-30 16:29
VLAI
EPSS
VEX
Title
Part-DB: Attachment Size Limit Bypass via API Base64 Upload
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. The application enforces the configured attachment size limit for normal browser-based file uploads, but the API base64 upload path does not apply the same size validation. As a result, an authenticated user with API access and permission to create attachments can upload files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 16:29 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 2.13.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86019",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T16:29:18.528680Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:29:23.553Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-8fvw-xrgv-jq4w"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 2.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. The application enforces the configured attachment size limit for normal browser-based file uploads, but the API base64 upload path does not apply the same size validation. As a result, an authenticated user with API access and permission to create attachments can upload files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T04:04:02.426Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-8fvw-xrgv-jq4w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-8fvw-xrgv-jq4w"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.2"
}
],
"source": {
"advisory": "GHSA-8fvw-xrgv-jq4w",
"discovery": "UNKNOWN"
},
"title": "Part-DB: Attachment Size Limit Bypass via API Base64 Upload"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-86019",
"datePublished": "2026-10-23T04:04:02.426Z",
"dateReserved": "2026-09-04T19:23:40.691Z",
"dateUpdated": "2026-10-30T16:29:23.553Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86018 (GCVE-0-2026-86018)
Vulnerability from nvd – Published: 2026-10-23 04:00 – Updated: 2026-10-29 02:47
VLAI
EPSS
VEX
Title
Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the configured MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 02:47 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 2.13.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86018",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T02:47:22.549895Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T02:47:47.732Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-2whx-2cx7-qvq6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 2.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side \u201cDownload external file\u201d attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the configured MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T04:00:19.188Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-2whx-2cx7-qvq6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-2whx-2cx7-qvq6"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.2"
}
],
"source": {
"advisory": "GHSA-2whx-2cx7-qvq6",
"discovery": "UNKNOWN"
},
"title": "Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-86018",
"datePublished": "2026-10-23T04:00:19.188Z",
"dateReserved": "2026-09-04T19:23:40.691Z",
"dateUpdated": "2026-10-29T02:47:47.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59188 (GCVE-0-2026-59188)
Vulnerability from nvd – Published: 2026-10-23 03:59 – Updated: 2026-10-29 12:49
VLAI
EPSS
VEX
Title
Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with JavaScript payload using a non-SVG extension (e.g., .jpg), bypassing sanitization entirely. When any user views the attachment inline, the browser receives Content-Type: image/svg+xml and executes the embedded script in the Part-DB origin. This issue has been patched in version 2.12.3.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 12:48 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 2.12.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59188",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T12:48:16.940583Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T12:49:30.293Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 2.12.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with JavaScript payload using a non-SVG extension (e.g., .jpg), bypassing sanitization entirely. When any user views the attachment inline, the browser receives Content-Type: image/svg+xml and executes the embedded script in the Part-DB origin. This issue has been patched in version 2.12.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T03:59:11.068Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-2vhp-c958-m47j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-2vhp-c958-m47j"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.3"
}
],
"source": {
"advisory": "GHSA-2vhp-c958-m47j",
"discovery": "UNKNOWN"
},
"title": "Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59188",
"datePublished": "2026-10-23T03:59:11.068Z",
"dateReserved": "2026-07-02T19:53:48.830Z",
"dateUpdated": "2026-10-29T12:49:30.293Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55600 (GCVE-0-2026-55600)
Vulnerability from nvd – Published: 2026-10-23 03:55 – Updated: 2026-10-30 16:30
VLAI
EPSS
VEX
Title
Part-DB: Stored HTML injection in BOM validation results via unescaped Part name
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a Part name can store HTML markup in the Part name. When another user imports a BOM CSV referencing that Part ID, the malicious Part name is rendered as HTML in the victim's BOM validation result page. This results in a cross-user stored HTML injection issue. JavaScript execution appears to be blocked by the current Content Security Policy, but arbitrary HTML links, forms, images, and CSS-based UI elements can still be injected into a trusted Part-DB page. This issue has been patched in version 2.12.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 16:30 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 2.12.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55600",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T16:30:51.129847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:30:57.428Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-qqrh-jjhg-vv5r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 2.12.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig\u0027s |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a Part name can store HTML markup in the Part name. When another user imports a BOM CSV referencing that Part ID, the malicious Part name is rendered as HTML in the victim\u0027s BOM validation result page. This results in a cross-user stored HTML injection issue. JavaScript execution appears to be blocked by the current Content Security Policy, but arbitrary HTML links, forms, images, and CSS-based UI elements can still be injected into a trusted Part-DB page. This issue has been patched in version 2.12.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T03:55:48.661Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-qqrh-jjhg-vv5r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-qqrh-jjhg-vv5r"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.2"
}
],
"source": {
"advisory": "GHSA-qqrh-jjhg-vv5r",
"discovery": "UNKNOWN"
},
"title": "Part-DB: Stored HTML injection in BOM validation results via unescaped Part name"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55600",
"datePublished": "2026-10-23T03:55:48.661Z",
"dateReserved": "2026-06-16T23:18:03.170Z",
"dateUpdated": "2026-10-30T16:30:57.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54631 (GCVE-0-2026-54631)
Vulnerability from nvd – Published: 2026-10-23 03:53 – Updated: 2026-10-29 02:46
VLAI
EPSS
VEX
Title
Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP_SECRET (a03498528f5a5fc089273ec9ae5b2849). The official Docker image jbtronics/part-db1 does not override or randomize this value at container start-up. Because Symfony uses APP_SECRET (via kernel.secret) as the HMAC key for signing remember-me cookies, any attacker who knows the secret -- or fetches it from the public repository -- can forge an arbitrary-user remember-me cookie and gain a fully authenticated session with no credentials required. This issue has been patched in version 2.12.1.
Severity
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 02:45 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 2.12.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54631",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T02:45:44.224219Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T02:46:18.989Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-99pw-2v29-v4wc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 2.12.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP_SECRET (a03498528f5a5fc089273ec9ae5b2849). The official Docker image jbtronics/part-db1 does not override or randomize this value at container start-up. Because Symfony uses APP_SECRET (via kernel.secret) as the HMAC key for signing remember-me cookies, any attacker who knows the secret -- or fetches it from the public repository -- can forge an arbitrary-user remember-me cookie and gain a fully authenticated session with no credentials required. This issue has been patched in version 2.12.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798: Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T03:53:33.833Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-99pw-2v29-v4wc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-99pw-2v29-v4wc"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.1"
}
],
"source": {
"advisory": "GHSA-99pw-2v29-v4wc",
"discovery": "UNKNOWN"
},
"title": "Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54631",
"datePublished": "2026-10-23T03:53:33.833Z",
"dateReserved": "2026-06-15T20:07:02.185Z",
"dateUpdated": "2026-10-29T02:46:18.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54630 (GCVE-0-2026-54630)
Vulnerability from nvd – Published: 2026-10-23 03:48 – Updated: 2026-10-29 12:43
VLAI
EPSS
VEX
Title
Part-DB: Authenticated RCE via .phar attachment upload served from public/media
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache document root. The shipped Apache configuration routes .phar to PHP-FPM, so the stored file is executed as PHP on request. The per-attachment-type extension filter is empty by default and is not consulted by the upload handler in a way that blocks this, and a non-admin user in the default users group can create an attachment type with no filter and attach files to parts. Any authenticated user in the default users group uploads a .phar attachment to a part and fetches it under /media/, executing arbitrary PHP as the www-data web user. Ability to exploit depends on the webserver config, docker image contained the vulnerability by default. This issue has been patched in version 2.12.1.
Severity
9.6 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 12:43 UTC
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 2.12.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54630",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T12:43:07.900819Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T12:43:48.850Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-w5m7-3xf7-6g7g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 2.12.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache document root. The shipped Apache configuration routes .phar to PHP-FPM, so the stored file is executed as PHP on request. The per-attachment-type extension filter is empty by default and is not consulted by the upload handler in a way that blocks this, and a non-admin user in the default users group can create an attachment type with no filter and attach files to parts. Any authenticated user in the default users group uploads a .phar attachment to a part and fetches it under /media/, executing arbitrary PHP as the www-data web user. Ability to exploit depends on the webserver config, docker image contained the vulnerability by default. This issue has been patched in version 2.12.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T03:48:59.951Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-w5m7-3xf7-6g7g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-w5m7-3xf7-6g7g"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.1"
}
],
"source": {
"advisory": "GHSA-w5m7-3xf7-6g7g",
"discovery": "UNKNOWN"
},
"title": "Part-DB: Authenticated RCE via .phar attachment upload served from public/media"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54630",
"datePublished": "2026-10-23T03:48:59.951Z",
"dateReserved": "2026-06-15T20:07:02.185Z",
"dateUpdated": "2026-10-29T12:43:48.850Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54615 (GCVE-0-2026-54615)
Vulnerability from nvd – Published: 2026-10-23 03:45 – Updated: 2026-10-23 15:00
VLAI
EPSS
VEX
Title
Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table (/log) and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat() runs user-controlled strings through htmlspecialchars() before placing them into the HTML it returns — except the CollectionElementDeleted branch, which interpolates getOldName() (and getCollectionName()) into a sprintf() template with no escaping. The returned string is emitted by LogEntryExtraColumn::render() and inserted as raw HTML into the DataTables cell (the bundle does not escape column output; sibling columns call htmlspecialchars() themselves). CollectionElementDeleted.getOldName() is the name of a deleted collection sub-element — a part Parameter, Attachment, PartLot, Orderdetail, etc. — all freely set by any user with edit rights on the owning element. A low-privileged content editor can therefore store an HTML/script payload as the name of such a sub-element, delete it (which writes the log entry), and have that markup parsed as live DOM in the browser of a higher-privileged victim (an administrator/auditor with system.show_logs, or any user viewing that element's history). This is a stored cross-site-scripting / HTML-injection defect caused by a single missed sanitizer in one sibling branch. CSP policies block inline javascript execution under normal conditions. This issue has been patched in version 2.12.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 14:48 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 2.12.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54615",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T14:48:39.941928Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T15:00:09.748Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 2.12.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the \"Extra\" column of the activity-log table (/log) and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat() runs user-controlled strings through htmlspecialchars() before placing them into the HTML it returns \u2014 except the CollectionElementDeleted branch, which interpolates getOldName() (and getCollectionName()) into a sprintf() template with no escaping. The returned string is emitted by LogEntryExtraColumn::render() and inserted as raw HTML into the DataTables cell (the bundle does not escape column output; sibling columns call htmlspecialchars() themselves). CollectionElementDeleted.getOldName() is the name of a deleted collection sub-element \u2014 a part Parameter, Attachment, PartLot, Orderdetail, etc. \u2014 all freely set by any user with edit rights on the owning element. A low-privileged content editor can therefore store an HTML/script payload as the name of such a sub-element, delete it (which writes the log entry), and have that markup parsed as live DOM in the browser of a higher-privileged victim (an administrator/auditor with system.show_logs, or any user viewing that element\u0027s history). This is a stored cross-site-scripting / HTML-injection defect caused by a single missed sanitizer in one sibling branch. CSP policies block inline javascript execution under normal conditions. This issue has been patched in version 2.12.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T03:45:02.512Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-gp89-jfq9-x8r9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-gp89-jfq9-x8r9"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.1"
}
],
"source": {
"advisory": "GHSA-gp89-jfq9-x8r9",
"discovery": "UNKNOWN"
},
"title": "Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54615",
"datePublished": "2026-10-23T03:45:02.512Z",
"dateReserved": "2026-06-15T20:07:02.184Z",
"dateUpdated": "2026-10-23T15:00:09.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2019-25432 (GCVE-0-2019-25432)
Vulnerability from nvd – Published: 2026-02-20 22:54 – Updated: 2026-04-07 14:03
VLAI
EPSS
VEX
Title
Part-DB 0.4 Authentication Bypass via login.php
Summary
Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to login by injecting SQL syntax into authentication parameters. Attackers can submit a single quote followed by 'or' in the login form to bypass credential validation and gain unauthorized access to the application.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-24 15:23 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/47547 | exploit |
| https://github.com/Part-DB/Part-DB/ | product |
| https://www.vulncheck.com/advisories/part-db-auth… | third-party-advisory |
Impacted products
Date Public
2019-10-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2019-25432",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-24T15:23:28.440390Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T15:23:40.735Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "0.4"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:part-db_project:part-db:0.4:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marvoloo"
}
],
"datePublic": "2019-10-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to login by injecting SQL syntax into authentication parameters. Attackers can submit a single quote followed by \u0027or\u0027 in the login form to bypass credential validation and gain unauthorized access to the application."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-07T14:03:58.140Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "ExploitDB-47547",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/47547"
},
{
"name": "Part-DB Legacy GitHub Repository",
"tags": [
"product"
],
"url": "https://github.com/Part-DB/Part-DB/"
},
{
"name": "VulnCheck Advisory: Part-DB 0.4 Authentication Bypass via login.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/part-db-authentication-bypass-via-loginphp"
}
],
"title": "Part-DB 0.4 Authentication Bypass via login.php",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2019-25432",
"datePublished": "2026-02-20T22:54:46.521Z",
"dateReserved": "2026-02-19T22:12:23.148Z",
"dateUpdated": "2026-04-07T14:03:58.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-55194 (GCVE-0-2025-55194)
Vulnerability from nvd – Published: 2025-08-13 22:46 – Updated: 2025-08-14 14:51
VLAI
EPSS
VEX
Title
Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension (e.g., .jpg.txt), resulting in a persistent 500 Internal Server Error when attempting to view or edit that user’s profile. This makes the profile permanently inaccessible via the UI for both users and administrators, constituting a Denial of Service (DoS) within the user management interface. This issue has been patched in version 1.17.3.
Severity
5.7 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-14 14:33 UTC
CWE
- CWE-248 - Uncaught Exception
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/commit/… | x_refsource_MISC |
| https://drive.google.com/file/d/10exp_BS9kRKHrFSP… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 1.17.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55194",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-14T14:33:50.624240Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-14T14:51:03.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/file/d/10exp_BS9kRKHrFSPjiA_ZYUVJbHN8doW/view"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-7rv3-rcxv-69ww"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 1.17.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension (e.g., .jpg.txt), resulting in a persistent 500 Internal Server Error when attempting to view or edit that user\u2019s profile. This makes the profile permanently inaccessible via the UI for both users and administrators, constituting a Denial of Service (DoS) within the user management interface. This issue has been patched in version 1.17.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248: Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-13T22:46:30.217Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-7rv3-rcxv-69ww",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-7rv3-rcxv-69ww"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/commit/d370f976a7b0c19d502aadbaa0f93eb90c2a6ffa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/commit/d370f976a7b0c19d502aadbaa0f93eb90c2a6ffa"
},
{
"name": "https://drive.google.com/file/d/10exp_BS9kRKHrFSPjiA_ZYUVJbHN8doW/view",
"tags": [
"x_refsource_MISC"
],
"url": "https://drive.google.com/file/d/10exp_BS9kRKHrFSPjiA_ZYUVJbHN8doW/view"
}
],
"source": {
"advisory": "GHSA-7rv3-rcxv-69ww",
"discovery": "UNKNOWN"
},
"title": "Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-55194",
"datePublished": "2025-08-13T22:46:30.217Z",
"dateReserved": "2025-08-08T21:55:07.963Z",
"dateUpdated": "2025-08-14T14:51:03.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-26042 (GCVE-0-2023-26042)
Vulnerability from nvd – Published: 2023-02-27 14:41 – Updated: 2025-03-10 17:48
VLAI
EPSS
VEX
Title
HTML/XSS injection possibilities in Part-DB
Summary
Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and external scripts so it is not possible to execute JavaScript code, unless in combination with other vulnerabilities. There are no workarounds, please upgrade to Pat-DB 1.0.2 or later.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-10 17:48 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/pull/227 | x_refsource_MISC |
| https://github.com/Part-DB/Part-DB-server/commit/… | x_refsource_MISC |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 1.0.2
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:39:06.446Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-9pmh-gmxx-rg2x",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-9pmh-gmxx-rg2x"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/pull/227",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Part-DB/Part-DB-server/pull/227"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/commit/5b7f44f4eaacad8a79bcedec32780e00d7347099",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Part-DB/Part-DB-server/commit/5b7f44f4eaacad8a79bcedec32780e00d7347099"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v1.0.2",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v1.0.2"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-26042",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-10T17:48:19.007569Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-10T17:48:28.160Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and external scripts so it is not possible to execute JavaScript code, unless in combination with other vulnerabilities. There are no workarounds, please upgrade to Pat-DB 1.0.2 or later."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-27T14:41:24.145Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-9pmh-gmxx-rg2x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-9pmh-gmxx-rg2x"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/pull/227",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/pull/227"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/commit/5b7f44f4eaacad8a79bcedec32780e00d7347099",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/commit/5b7f44f4eaacad8a79bcedec32780e00d7347099"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v1.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v1.0.2"
}
],
"source": {
"advisory": "GHSA-9pmh-gmxx-rg2x",
"discovery": "UNKNOWN"
},
"title": "HTML/XSS injection possibilities in Part-DB "
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-26042",
"datePublished": "2023-02-27T14:41:24.145Z",
"dateReserved": "2023-02-17T22:44:03.149Z",
"dateUpdated": "2025-03-10T17:48:28.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-0848 (GCVE-0-2022-0848)
Vulnerability from nvd – Published: 2022-03-04 08:25 – Updated: 2024-08-02 23:40
VLAI
EPSS
VEX
Title
OS Command Injection in part-db/part-db
Summary
OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11.
Severity
10 (Critical)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command
References
3 references
| URL | Tags |
|---|---|
| https://huntr.dev/bounties/3e91685f-cfb9-4ee4-aba… | x_refsource_CONFIRM |
| https://github.com/part-db/part-db/commit/9cd4eee… | x_refsource_MISC |
| http://packetstormsecurity.com/files/166217/part-… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| part-db | part-db/part-db |
Affected:
unspecified , < 0.5.11
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:40:04.503Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/3e91685f-cfb9-4ee4-abaf-9b712a8fd5a6"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/part-db/part-db/commit/9cd4eee393028aa4cab70fcbac284b0028c0bc95"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/166217/part-db-0.5.11-Remote-Code-Execution.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "part-db/part-db",
"vendor": "part-db",
"versions": [
{
"lessThan": "0.5.11",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-07T17:06:22.000Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/3e91685f-cfb9-4ee4-abaf-9b712a8fd5a6"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/part-db/part-db/commit/9cd4eee393028aa4cab70fcbac284b0028c0bc95"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/166217/part-db-0.5.11-Remote-Code-Execution.html"
}
],
"source": {
"advisory": "3e91685f-cfb9-4ee4-abaf-9b712a8fd5a6",
"discovery": "EXTERNAL"
},
"title": "OS Command Injection in part-db/part-db",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-0848",
"STATE": "PUBLIC",
"TITLE": "OS Command Injection in part-db/part-db"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "part-db/part-db",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "0.5.11"
}
]
}
}
]
},
"vendor_name": "part-db"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78 Improper Neutralization of Special Elements used in an OS Command"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/3e91685f-cfb9-4ee4-abaf-9b712a8fd5a6",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/3e91685f-cfb9-4ee4-abaf-9b712a8fd5a6"
},
{
"name": "https://github.com/part-db/part-db/commit/9cd4eee393028aa4cab70fcbac284b0028c0bc95",
"refsource": "MISC",
"url": "https://github.com/part-db/part-db/commit/9cd4eee393028aa4cab70fcbac284b0028c0bc95"
},
{
"name": "http://packetstormsecurity.com/files/166217/part-db-0.5.11-Remote-Code-Execution.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/166217/part-db-0.5.11-Remote-Code-Execution.html"
}
]
},
"source": {
"advisory": "3e91685f-cfb9-4ee4-abaf-9b712a8fd5a6",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-0848",
"datePublished": "2022-03-04T08:25:10.000Z",
"dateReserved": "2022-03-04T00:00:00.000Z",
"dateUpdated": "2024-08-02T23:40:04.503Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-86055 (GCVE-0-2026-86055)
Vulnerability from cvelistv5 – Published: 2026-10-23 04:09 – Updated: 2026-10-29 12:56
VLAI
EPSS
VEX
Title
Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who submits a forgot-password request for a known account while sending a spoofed Host header causes Part-DB to email that account a reset link whose hostname is attacker-controlled, while still embedding the genuine reset token. When the victim opens the link (or an automated inbound mail-security scanner dereferences it), the valid token is disclosed to the attacker, who replays it against the real instance to set a new password and take over the account. Because the seeded admin account can be targeted, this yields full pre-authentication administrative account takeover. This issue has been patched in version 2.13.3.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 12:52 UTC
CWE
- CWE-640 - Weak Password Recovery Mechanism for Forgotten Password
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 2.13.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86055",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T12:52:45.808126Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T12:56:48.256Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-m9rf-69wp-c56r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 2.13.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who submits a forgot-password request for a known account while sending a spoofed Host header causes Part-DB to email that account a reset link whose hostname is attacker-controlled, while still embedding the genuine reset token. When the victim opens the link (or an automated inbound mail-security scanner dereferences it), the valid token is disclosed to the attacker, who replays it against the real instance to set a new password and take over the account. Because the seeded admin account can be targeted, this yields full pre-authentication administrative account takeover. This issue has been patched in version 2.13.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T04:09:27.051Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-m9rf-69wp-c56r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-m9rf-69wp-c56r"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.3"
}
],
"source": {
"advisory": "GHSA-m9rf-69wp-c56r",
"discovery": "UNKNOWN"
},
"title": "Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-86055",
"datePublished": "2026-10-23T04:09:27.051Z",
"dateReserved": "2026-09-04T19:29:21.059Z",
"dateUpdated": "2026-10-29T12:56:48.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86020 (GCVE-0-2026-86020)
Vulnerability from cvelistv5 – Published: 2026-10-23 04:05 – Updated: 2026-10-23 14:59
VLAI
EPSS
VEX
Title
Part-DB: Spreadsheet Formula Injection in XLSX Part Exports
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.
Severity
4.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 14:48 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 2.13.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86020",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T14:48:41.603210Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T14:59:59.159Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 2.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet\u0027s setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "CWE-1236: Improper Neutralization of Formula Elements in a CSV File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T04:05:24.420Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-hxw4-frfg-f8jw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-hxw4-frfg-f8jw"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.2"
}
],
"source": {
"advisory": "GHSA-hxw4-frfg-f8jw",
"discovery": "UNKNOWN"
},
"title": "Part-DB: Spreadsheet Formula Injection in XLSX Part Exports"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-86020",
"datePublished": "2026-10-23T04:05:24.420Z",
"dateReserved": "2026-09-04T19:23:40.691Z",
"dateUpdated": "2026-10-23T14:59:59.159Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86019 (GCVE-0-2026-86019)
Vulnerability from cvelistv5 – Published: 2026-10-23 04:04 – Updated: 2026-10-30 16:29
VLAI
EPSS
VEX
Title
Part-DB: Attachment Size Limit Bypass via API Base64 Upload
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. The application enforces the configured attachment size limit for normal browser-based file uploads, but the API base64 upload path does not apply the same size validation. As a result, an authenticated user with API access and permission to create attachments can upload files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 16:29 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 2.13.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86019",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T16:29:18.528680Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:29:23.553Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-8fvw-xrgv-jq4w"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 2.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. The application enforces the configured attachment size limit for normal browser-based file uploads, but the API base64 upload path does not apply the same size validation. As a result, an authenticated user with API access and permission to create attachments can upload files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T04:04:02.426Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-8fvw-xrgv-jq4w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-8fvw-xrgv-jq4w"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.2"
}
],
"source": {
"advisory": "GHSA-8fvw-xrgv-jq4w",
"discovery": "UNKNOWN"
},
"title": "Part-DB: Attachment Size Limit Bypass via API Base64 Upload"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-86019",
"datePublished": "2026-10-23T04:04:02.426Z",
"dateReserved": "2026-09-04T19:23:40.691Z",
"dateUpdated": "2026-10-30T16:29:23.553Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86018 (GCVE-0-2026-86018)
Vulnerability from cvelistv5 – Published: 2026-10-23 04:00 – Updated: 2026-10-29 02:47
VLAI
EPSS
VEX
Title
Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the configured MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 02:47 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 2.13.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86018",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T02:47:22.549895Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T02:47:47.732Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-2whx-2cx7-qvq6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 2.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side \u201cDownload external file\u201d attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the configured MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T04:00:19.188Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-2whx-2cx7-qvq6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-2whx-2cx7-qvq6"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.2"
}
],
"source": {
"advisory": "GHSA-2whx-2cx7-qvq6",
"discovery": "UNKNOWN"
},
"title": "Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-86018",
"datePublished": "2026-10-23T04:00:19.188Z",
"dateReserved": "2026-09-04T19:23:40.691Z",
"dateUpdated": "2026-10-29T02:47:47.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59188 (GCVE-0-2026-59188)
Vulnerability from cvelistv5 – Published: 2026-10-23 03:59 – Updated: 2026-10-29 12:49
VLAI
EPSS
VEX
Title
Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with JavaScript payload using a non-SVG extension (e.g., .jpg), bypassing sanitization entirely. When any user views the attachment inline, the browser receives Content-Type: image/svg+xml and executes the embedded script in the Part-DB origin. This issue has been patched in version 2.12.3.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 12:48 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 2.12.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59188",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T12:48:16.940583Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T12:49:30.293Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 2.12.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with JavaScript payload using a non-SVG extension (e.g., .jpg), bypassing sanitization entirely. When any user views the attachment inline, the browser receives Content-Type: image/svg+xml and executes the embedded script in the Part-DB origin. This issue has been patched in version 2.12.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T03:59:11.068Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-2vhp-c958-m47j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-2vhp-c958-m47j"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.3"
}
],
"source": {
"advisory": "GHSA-2vhp-c958-m47j",
"discovery": "UNKNOWN"
},
"title": "Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59188",
"datePublished": "2026-10-23T03:59:11.068Z",
"dateReserved": "2026-07-02T19:53:48.830Z",
"dateUpdated": "2026-10-29T12:49:30.293Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55600 (GCVE-0-2026-55600)
Vulnerability from cvelistv5 – Published: 2026-10-23 03:55 – Updated: 2026-10-30 16:30
VLAI
EPSS
VEX
Title
Part-DB: Stored HTML injection in BOM validation results via unescaped Part name
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a Part name can store HTML markup in the Part name. When another user imports a BOM CSV referencing that Part ID, the malicious Part name is rendered as HTML in the victim's BOM validation result page. This results in a cross-user stored HTML injection issue. JavaScript execution appears to be blocked by the current Content Security Policy, but arbitrary HTML links, forms, images, and CSS-based UI elements can still be injected into a trusted Part-DB page. This issue has been patched in version 2.12.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 16:30 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 2.12.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55600",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T16:30:51.129847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:30:57.428Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-qqrh-jjhg-vv5r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 2.12.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig\u0027s |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a Part name can store HTML markup in the Part name. When another user imports a BOM CSV referencing that Part ID, the malicious Part name is rendered as HTML in the victim\u0027s BOM validation result page. This results in a cross-user stored HTML injection issue. JavaScript execution appears to be blocked by the current Content Security Policy, but arbitrary HTML links, forms, images, and CSS-based UI elements can still be injected into a trusted Part-DB page. This issue has been patched in version 2.12.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T03:55:48.661Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-qqrh-jjhg-vv5r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-qqrh-jjhg-vv5r"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.2"
}
],
"source": {
"advisory": "GHSA-qqrh-jjhg-vv5r",
"discovery": "UNKNOWN"
},
"title": "Part-DB: Stored HTML injection in BOM validation results via unescaped Part name"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55600",
"datePublished": "2026-10-23T03:55:48.661Z",
"dateReserved": "2026-06-16T23:18:03.170Z",
"dateUpdated": "2026-10-30T16:30:57.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54631 (GCVE-0-2026-54631)
Vulnerability from cvelistv5 – Published: 2026-10-23 03:53 – Updated: 2026-10-29 02:46
VLAI
EPSS
VEX
Title
Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP_SECRET (a03498528f5a5fc089273ec9ae5b2849). The official Docker image jbtronics/part-db1 does not override or randomize this value at container start-up. Because Symfony uses APP_SECRET (via kernel.secret) as the HMAC key for signing remember-me cookies, any attacker who knows the secret -- or fetches it from the public repository -- can forge an arbitrary-user remember-me cookie and gain a fully authenticated session with no credentials required. This issue has been patched in version 2.12.1.
Severity
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 02:45 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 2.12.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54631",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T02:45:44.224219Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T02:46:18.989Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-99pw-2v29-v4wc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 2.12.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP_SECRET (a03498528f5a5fc089273ec9ae5b2849). The official Docker image jbtronics/part-db1 does not override or randomize this value at container start-up. Because Symfony uses APP_SECRET (via kernel.secret) as the HMAC key for signing remember-me cookies, any attacker who knows the secret -- or fetches it from the public repository -- can forge an arbitrary-user remember-me cookie and gain a fully authenticated session with no credentials required. This issue has been patched in version 2.12.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798: Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T03:53:33.833Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-99pw-2v29-v4wc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-99pw-2v29-v4wc"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.1"
}
],
"source": {
"advisory": "GHSA-99pw-2v29-v4wc",
"discovery": "UNKNOWN"
},
"title": "Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54631",
"datePublished": "2026-10-23T03:53:33.833Z",
"dateReserved": "2026-06-15T20:07:02.185Z",
"dateUpdated": "2026-10-29T02:46:18.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54630 (GCVE-0-2026-54630)
Vulnerability from cvelistv5 – Published: 2026-10-23 03:48 – Updated: 2026-10-29 12:43
VLAI
EPSS
VEX
Title
Part-DB: Authenticated RCE via .phar attachment upload served from public/media
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache document root. The shipped Apache configuration routes .phar to PHP-FPM, so the stored file is executed as PHP on request. The per-attachment-type extension filter is empty by default and is not consulted by the upload handler in a way that blocks this, and a non-admin user in the default users group can create an attachment type with no filter and attach files to parts. Any authenticated user in the default users group uploads a .phar attachment to a part and fetches it under /media/, executing arbitrary PHP as the www-data web user. Ability to exploit depends on the webserver config, docker image contained the vulnerability by default. This issue has been patched in version 2.12.1.
Severity
9.6 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 12:43 UTC
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 2.12.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54630",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T12:43:07.900819Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T12:43:48.850Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-w5m7-3xf7-6g7g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 2.12.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache document root. The shipped Apache configuration routes .phar to PHP-FPM, so the stored file is executed as PHP on request. The per-attachment-type extension filter is empty by default and is not consulted by the upload handler in a way that blocks this, and a non-admin user in the default users group can create an attachment type with no filter and attach files to parts. Any authenticated user in the default users group uploads a .phar attachment to a part and fetches it under /media/, executing arbitrary PHP as the www-data web user. Ability to exploit depends on the webserver config, docker image contained the vulnerability by default. This issue has been patched in version 2.12.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T03:48:59.951Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-w5m7-3xf7-6g7g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-w5m7-3xf7-6g7g"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.1"
}
],
"source": {
"advisory": "GHSA-w5m7-3xf7-6g7g",
"discovery": "UNKNOWN"
},
"title": "Part-DB: Authenticated RCE via .phar attachment upload served from public/media"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54630",
"datePublished": "2026-10-23T03:48:59.951Z",
"dateReserved": "2026-06-15T20:07:02.185Z",
"dateUpdated": "2026-10-29T12:43:48.850Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54615 (GCVE-0-2026-54615)
Vulnerability from cvelistv5 – Published: 2026-10-23 03:45 – Updated: 2026-10-23 15:00
VLAI
EPSS
VEX
Title
Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table (/log) and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat() runs user-controlled strings through htmlspecialchars() before placing them into the HTML it returns — except the CollectionElementDeleted branch, which interpolates getOldName() (and getCollectionName()) into a sprintf() template with no escaping. The returned string is emitted by LogEntryExtraColumn::render() and inserted as raw HTML into the DataTables cell (the bundle does not escape column output; sibling columns call htmlspecialchars() themselves). CollectionElementDeleted.getOldName() is the name of a deleted collection sub-element — a part Parameter, Attachment, PartLot, Orderdetail, etc. — all freely set by any user with edit rights on the owning element. A low-privileged content editor can therefore store an HTML/script payload as the name of such a sub-element, delete it (which writes the log entry), and have that markup parsed as live DOM in the browser of a higher-privileged victim (an administrator/auditor with system.show_logs, or any user viewing that element's history). This is a stored cross-site-scripting / HTML-injection defect caused by a single missed sanitizer in one sibling branch. CSP policies block inline javascript execution under normal conditions. This issue has been patched in version 2.12.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 14:48 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 2.12.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54615",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T14:48:39.941928Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T15:00:09.748Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 2.12.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the \"Extra\" column of the activity-log table (/log) and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat() runs user-controlled strings through htmlspecialchars() before placing them into the HTML it returns \u2014 except the CollectionElementDeleted branch, which interpolates getOldName() (and getCollectionName()) into a sprintf() template with no escaping. The returned string is emitted by LogEntryExtraColumn::render() and inserted as raw HTML into the DataTables cell (the bundle does not escape column output; sibling columns call htmlspecialchars() themselves). CollectionElementDeleted.getOldName() is the name of a deleted collection sub-element \u2014 a part Parameter, Attachment, PartLot, Orderdetail, etc. \u2014 all freely set by any user with edit rights on the owning element. A low-privileged content editor can therefore store an HTML/script payload as the name of such a sub-element, delete it (which writes the log entry), and have that markup parsed as live DOM in the browser of a higher-privileged victim (an administrator/auditor with system.show_logs, or any user viewing that element\u0027s history). This is a stored cross-site-scripting / HTML-injection defect caused by a single missed sanitizer in one sibling branch. CSP policies block inline javascript execution under normal conditions. This issue has been patched in version 2.12.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T03:45:02.512Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-gp89-jfq9-x8r9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-gp89-jfq9-x8r9"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.1"
}
],
"source": {
"advisory": "GHSA-gp89-jfq9-x8r9",
"discovery": "UNKNOWN"
},
"title": "Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54615",
"datePublished": "2026-10-23T03:45:02.512Z",
"dateReserved": "2026-06-15T20:07:02.184Z",
"dateUpdated": "2026-10-23T15:00:09.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2019-25432 (GCVE-0-2019-25432)
Vulnerability from cvelistv5 – Published: 2026-02-20 22:54 – Updated: 2026-04-07 14:03
VLAI
EPSS
VEX
Title
Part-DB 0.4 Authentication Bypass via login.php
Summary
Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to login by injecting SQL syntax into authentication parameters. Attackers can submit a single quote followed by 'or' in the login form to bypass credential validation and gain unauthorized access to the application.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-24 15:23 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/47547 | exploit |
| https://github.com/Part-DB/Part-DB/ | product |
| https://www.vulncheck.com/advisories/part-db-auth… | third-party-advisory |
Impacted products
Date Public
2019-10-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2019-25432",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-24T15:23:28.440390Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T15:23:40.735Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "0.4"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:part-db_project:part-db:0.4:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marvoloo"
}
],
"datePublic": "2019-10-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to login by injecting SQL syntax into authentication parameters. Attackers can submit a single quote followed by \u0027or\u0027 in the login form to bypass credential validation and gain unauthorized access to the application."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-07T14:03:58.140Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "ExploitDB-47547",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/47547"
},
{
"name": "Part-DB Legacy GitHub Repository",
"tags": [
"product"
],
"url": "https://github.com/Part-DB/Part-DB/"
},
{
"name": "VulnCheck Advisory: Part-DB 0.4 Authentication Bypass via login.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/part-db-authentication-bypass-via-loginphp"
}
],
"title": "Part-DB 0.4 Authentication Bypass via login.php",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2019-25432",
"datePublished": "2026-02-20T22:54:46.521Z",
"dateReserved": "2026-02-19T22:12:23.148Z",
"dateUpdated": "2026-04-07T14:03:58.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-55194 (GCVE-0-2025-55194)
Vulnerability from cvelistv5 – Published: 2025-08-13 22:46 – Updated: 2025-08-14 14:51
VLAI
EPSS
VEX
Title
Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload
Summary
Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension (e.g., .jpg.txt), resulting in a persistent 500 Internal Server Error when attempting to view or edit that user’s profile. This makes the profile permanently inaccessible via the UI for both users and administrators, constituting a Denial of Service (DoS) within the user management interface. This issue has been patched in version 1.17.3.
Severity
5.7 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-14 14:33 UTC
CWE
- CWE-248 - Uncaught Exception
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/commit/… | x_refsource_MISC |
| https://drive.google.com/file/d/10exp_BS9kRKHrFSP… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 1.17.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55194",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-14T14:33:50.624240Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-14T14:51:03.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/file/d/10exp_BS9kRKHrFSPjiA_ZYUVJbHN8doW/view"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-7rv3-rcxv-69ww"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 1.17.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension (e.g., .jpg.txt), resulting in a persistent 500 Internal Server Error when attempting to view or edit that user\u2019s profile. This makes the profile permanently inaccessible via the UI for both users and administrators, constituting a Denial of Service (DoS) within the user management interface. This issue has been patched in version 1.17.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248: Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-13T22:46:30.217Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-7rv3-rcxv-69ww",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-7rv3-rcxv-69ww"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/commit/d370f976a7b0c19d502aadbaa0f93eb90c2a6ffa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/commit/d370f976a7b0c19d502aadbaa0f93eb90c2a6ffa"
},
{
"name": "https://drive.google.com/file/d/10exp_BS9kRKHrFSPjiA_ZYUVJbHN8doW/view",
"tags": [
"x_refsource_MISC"
],
"url": "https://drive.google.com/file/d/10exp_BS9kRKHrFSPjiA_ZYUVJbHN8doW/view"
}
],
"source": {
"advisory": "GHSA-7rv3-rcxv-69ww",
"discovery": "UNKNOWN"
},
"title": "Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-55194",
"datePublished": "2025-08-13T22:46:30.217Z",
"dateReserved": "2025-08-08T21:55:07.963Z",
"dateUpdated": "2025-08-14T14:51:03.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-26042 (GCVE-0-2023-26042)
Vulnerability from cvelistv5 – Published: 2023-02-27 14:41 – Updated: 2025-03-10 17:48
VLAI
EPSS
VEX
Title
HTML/XSS injection possibilities in Part-DB
Summary
Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and external scripts so it is not possible to execute JavaScript code, unless in combination with other vulnerabilities. There are no workarounds, please upgrade to Pat-DB 1.0.2 or later.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-10 17:48 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Part-DB/Part-DB-server/securit… | x_refsource_CONFIRM |
| https://github.com/Part-DB/Part-DB-server/pull/227 | x_refsource_MISC |
| https://github.com/Part-DB/Part-DB-server/commit/… | x_refsource_MISC |
| https://github.com/Part-DB/Part-DB-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Part-DB | Part-DB-server |
Affected:
< 1.0.2
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:39:06.446Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-9pmh-gmxx-rg2x",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-9pmh-gmxx-rg2x"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/pull/227",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Part-DB/Part-DB-server/pull/227"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/commit/5b7f44f4eaacad8a79bcedec32780e00d7347099",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Part-DB/Part-DB-server/commit/5b7f44f4eaacad8a79bcedec32780e00d7347099"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v1.0.2",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v1.0.2"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-26042",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-10T17:48:19.007569Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-10T17:48:28.160Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Part-DB-server",
"vendor": "Part-DB",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and external scripts so it is not possible to execute JavaScript code, unless in combination with other vulnerabilities. There are no workarounds, please upgrade to Pat-DB 1.0.2 or later."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-27T14:41:24.145Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-9pmh-gmxx-rg2x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-9pmh-gmxx-rg2x"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/pull/227",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/pull/227"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/commit/5b7f44f4eaacad8a79bcedec32780e00d7347099",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/commit/5b7f44f4eaacad8a79bcedec32780e00d7347099"
},
{
"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v1.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v1.0.2"
}
],
"source": {
"advisory": "GHSA-9pmh-gmxx-rg2x",
"discovery": "UNKNOWN"
},
"title": "HTML/XSS injection possibilities in Part-DB "
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-26042",
"datePublished": "2023-02-27T14:41:24.145Z",
"dateReserved": "2023-02-17T22:44:03.149Z",
"dateUpdated": "2025-03-10T17:48:28.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-0848 (GCVE-0-2022-0848)
Vulnerability from cvelistv5 – Published: 2022-03-04 08:25 – Updated: 2024-08-02 23:40
VLAI
EPSS
VEX
Title
OS Command Injection in part-db/part-db
Summary
OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11.
Severity
10 (Critical)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command
References
3 references
| URL | Tags |
|---|---|
| https://huntr.dev/bounties/3e91685f-cfb9-4ee4-aba… | x_refsource_CONFIRM |
| https://github.com/part-db/part-db/commit/9cd4eee… | x_refsource_MISC |
| http://packetstormsecurity.com/files/166217/part-… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| part-db | part-db/part-db |
Affected:
unspecified , < 0.5.11
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:40:04.503Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/3e91685f-cfb9-4ee4-abaf-9b712a8fd5a6"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/part-db/part-db/commit/9cd4eee393028aa4cab70fcbac284b0028c0bc95"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/166217/part-db-0.5.11-Remote-Code-Execution.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "part-db/part-db",
"vendor": "part-db",
"versions": [
{
"lessThan": "0.5.11",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-07T17:06:22.000Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/3e91685f-cfb9-4ee4-abaf-9b712a8fd5a6"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/part-db/part-db/commit/9cd4eee393028aa4cab70fcbac284b0028c0bc95"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/166217/part-db-0.5.11-Remote-Code-Execution.html"
}
],
"source": {
"advisory": "3e91685f-cfb9-4ee4-abaf-9b712a8fd5a6",
"discovery": "EXTERNAL"
},
"title": "OS Command Injection in part-db/part-db",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-0848",
"STATE": "PUBLIC",
"TITLE": "OS Command Injection in part-db/part-db"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "part-db/part-db",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "0.5.11"
}
]
}
}
]
},
"vendor_name": "part-db"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78 Improper Neutralization of Special Elements used in an OS Command"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/3e91685f-cfb9-4ee4-abaf-9b712a8fd5a6",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/3e91685f-cfb9-4ee4-abaf-9b712a8fd5a6"
},
{
"name": "https://github.com/part-db/part-db/commit/9cd4eee393028aa4cab70fcbac284b0028c0bc95",
"refsource": "MISC",
"url": "https://github.com/part-db/part-db/commit/9cd4eee393028aa4cab70fcbac284b0028c0bc95"
},
{
"name": "http://packetstormsecurity.com/files/166217/part-db-0.5.11-Remote-Code-Execution.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/166217/part-db-0.5.11-Remote-Code-Execution.html"
}
]
},
"source": {
"advisory": "3e91685f-cfb9-4ee4-abaf-9b712a8fd5a6",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-0848",
"datePublished": "2022-03-04T08:25:10.000Z",
"dateReserved": "2022-03-04T00:00:00.000Z",
"dateUpdated": "2024-08-02T23:40:04.503Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}