Part-db vulnerabilities

Products

• Part-db-server 11
• Part-db 2

Newest

• part-db part-db-server Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover CVE-2026-86055 8.7 HighOctober 23, 2026
• part-db part-db-server Part-DB: Spreadsheet Formula Injection in XLSX Part Exports CVE-2026-86020 4.6 MediumOctober 23, 2026
• part-db part-db-server Part-DB: Attachment Size Limit Bypass via API Base64 Upload CVE-2026-86019 5.3 MediumOctober 23, 2026
• part-db part-db-server Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads CVE-2026-86018 5.3 MediumOctober 23, 2026
• part-db part-db-server Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer CVE-2026-59188 5.4 MediumOctober 23, 2026
• part-db part-db-server Part-DB: Stored HTML injection in BOM validation results via unescaped Part name CVE-2026-55600 5.7 MediumOctober 23, 2026
• part-db part-db-server Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie CVE-2026-54631 6.3 MediumOctober 23, 2026
• part-db part-db-server Part-DB: Authenticated RCE via .phar attachment upload served from public/media CVE-2026-54630 9.6 CriticalOctober 23, 2026
• part-db part-db-server Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap) CVE-2026-54615 6.0 MediumOctober 23, 2026
• part-db Part-DB 0.4 Authentication Bypass via login.php CVE-2019-25432 8.8 HighFebruary 20, 2026
• part-db project part-db, part-db part-db-server +1 more Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload CVE-2025-55194 5.7 MediumAugust 13, 2025
• part-db Part-DB Profile Picture Feature AttachmentSubmitHandler.php handleUpload cross site scripting CVE-2025-5007 5.1 MediumMay 20, 2025
• part-db project part-db, part-db part-db-server +1 more HTML/XSS injection possibilities in Part-DB CVE-2023-26042 6.1 MediumFebruary 27, 2023
• part-db part-db/part-db, part-db project part-db +1 more OS Command Injection in part-db/part-db CVE-2022-0848 Public exploit EPSS 35.4% 10.0 CriticalMarch 4, 2022