Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

part-db — Vulnerabilities & Security Advisories 13

Browse all 13 CVE security advisories affecting part-db. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Part-db serves as an inventory management system for electronic components, enabling users to track parts, suppliers, and projects. Historically, it has been susceptible to multiple remote code execution vulnerabilities, cross-site scripting flaws, and privilege escalation issues, often stemming from insufficient input validation and access controls. The application's web interface and database integration have created attack surfaces for unauthorized access. While no major public security incidents have been documented, the four recorded CVEs highlight consistent security concerns in areas such as file handling and authentication. Users should implement strict access controls and maintain regular updates to mitigate risks associated with these common vulnerability classes.

CVE ID Title CVSS Severity Published
CVE-2026-86055 Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover — Part-DB-server CWE-640 8.7 High 2026-10-23
CVE-2026-86020 Part-DB: Spreadsheet Formula Injection in XLSX Part Exports — Part-DB-server CWE-20 4.6 Medium 2026-10-23
CVE-2026-86019 Part-DB: Attachment Size Limit Bypass via API Base64 Upload — Part-DB-server CWE-400 5.3 Medium 2026-10-23
CVE-2026-86018 Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads — Part-DB-server CWE-400 5.3 Medium 2026-10-23
CVE-2026-59188 Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer — Part-DB-server CWE-79 5.4 Medium 2026-10-23
CVE-2026-55600 Part-DB: Stored HTML injection in BOM validation results via unescaped Part name — Part-DB-server CWE-79 5.7 Medium 2026-10-23
CVE-2026-54631 Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie — Part-DB-server CWE-798 6.3 Medium 2026-10-23
CVE-2026-54630 Part-DB: Authenticated RCE via .phar attachment upload served from public/media — Part-DB-server CWE-434 9.6 Critical 2026-10-23
CVE-2026-54615 Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap) — Part-DB-server CWE-79 6.0 Medium 2026-10-23
CVE-2019-25432 Part-DB 0.4 Authentication Bypass via login.php — Part-DB CWE-89 7.5 High 2026-02-20
CVE-2025-55194 Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload — Part-DB-server CWE-248 5.7 Medium 2025-08-13
CVE-2023-26042 HTML/XSS injection possibilities in Part-DB — Part-DB-server CWE-79 6.1 Medium 2023-02-27
CVE-2022-0848 OS Command Injection in part-db/part-db — part-db/part-db CWE-78 9.8 - 2022-03-04

This page lists every published CVE security advisory associated with part-db. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.