Part-DB-server — Vulnerabilities & Security Advisories 11

All 11 CVE vulnerabilities found in Part-DB-server, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-86055	Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover CWE-640	8.7	High	2026-10-23
CVE-2026-86020	Part-DB: Spreadsheet Formula Injection in XLSX Part Exports CWE-20	4.6	Medium	2026-10-23
CVE-2026-86019	Part-DB: Attachment Size Limit Bypass via API Base64 Upload CWE-400	5.3	Medium	2026-10-23
CVE-2026-86018	Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads CWE-400	5.3	Medium	2026-10-23
CVE-2026-59188	Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer CWE-79	5.4	Medium	2026-10-23
CVE-2026-55600	Part-DB: Stored HTML injection in BOM validation results via unescaped Part name CWE-79	5.7	Medium	2026-10-23
CVE-2026-54631	Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie CWE-798	6.3	Medium	2026-10-23
CVE-2026-54630	Part-DB: Authenticated RCE via .phar attachment upload served from public/media CWE-434	9.6	Critical	2026-10-23
CVE-2026-54615	Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap) CWE-79	6.0	Medium	2026-10-23
CVE-2025-55194	Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload CWE-248	5.7	Medium	2025-08-13
CVE-2023-26042	HTML/XSS injection possibilities in Part-DB CWE-79	6.1	Medium	2023-02-27

All 11 known CVE vulnerabilities affecting Part-DB-server with full Chinese analysis, references, and POCs where available.