What’s Vulnerable › Products

Part-DB-server vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your Part-DB-server version is affected

Latest Part-DB-server vulnerabilities

• CVE-2026-54615 — Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap) (CVSS 6.0)
• CVE-2026-86055 — Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover (CVSS 8.7)
• CVE-2026-86020 — Part-DB: Spreadsheet Formula Injection in XLSX Part Exports (CVSS 4.6)
• CVE-2026-86019 — Part-DB: Attachment Size Limit Bypass via API Base64 Upload (CVSS 5.3)
• CVE-2026-86018 — Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads (CVSS 5.3)
• CVE-2026-59188 — Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer (CVSS 5.4)
• CVE-2026-55600 — Part-DB: Stored HTML injection in BOM validation results via unescaped Part name (CVSS 5.7)
• CVE-2026-54631 — Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie (CVSS 6.3)
• CVE-2026-54630 — Part-DB: Authenticated RCE via .phar attachment upload served from public/media (CVSS 9.6)
• CVE-2019-25432 — Part-DB 0.4 Authentication Bypass via login.php (CVSS 7.5)
• CVE-2025-55194 — Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload (CVSS 5.7)
• CVE-2023-26042 — HTML/XSS injection possibilities in Part-DB (CVSS 6.1)
• CVE-2022-0848 — OS Command Injection in part-db/part-db (CVSS 9.8)