Vulnerabilities

TI-2026-79546 CVE-2026-86055

Password reset link poisoning in Part-DB allows account takeover

HIGH 79

Part-DB is an open source inventory management system for electronic components.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00591 Published 2026-10-23 Fixed in 2.13.3 CWE-640

TI-2026-79545 CVE-2026-86020

Spreadsheet formula injection in Part-DB XLSX part exports

LOW 20

Part-DB is an open source inventory management system for electronic components.

CVSS 3.1MEDIUM 4.6 Local Low privileges User interaction EPSS 0.00155 Published 2026-10-23 Fixed in 2.13.2 CWE-1236

TI-2026-79544 CVE-2026-86019

Attachment size limit bypass in Part-DB via API base64 upload

MEDIUM 57

Part-DB is an open source inventory management system for electronic components.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00371 Published 2026-10-23 Fixed in 2.13.2 CWE-400

TI-2026-79543 CVE-2026-86018

Part-DB attachment downloads let users exhaust disk space

MEDIUM 57

Part-DB is an open source inventory management system for electronic components.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00405 Published 2026-10-23 Fixed in 2.13.2 CWE-400

TI-2026-79542 CVE-2026-59188

Stored XSS in Part-DB attachment viewer via SVG sanitization bypass

MEDIUM 58

Part-DB is an open source inventory management system for electronic components.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0015 Published 2026-10-23 Fixed in 2.12.3 CWE-434

TI-2026-79540 CVE-2026-55600

Stored HTML injection in Part-DB BOM validation results

MEDIUM 59

Part-DB is an open source inventory management system for electronic components.

CVSS 4.0MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00443 Published 2026-10-23 Fixed in 2.12.2 CWE-79

TI-2026-79539 CVE-2026-54631

Hardcoded APP_SECRET in Part-DB enables forged login cookies

MEDIUM 63

Part-DB is an open source inventory management system for electronic components.

CVSS 3.1MEDIUM 6.3 Local High privileges No interaction EPSS 0.00191 Published 2026-10-23 Fixed in 2.12.1 CWE-798

TI-2026-79538 CVE-2026-54630

Part-DB attachment upload allows PHP execution via .phar files

HIGH 76

Part-DB is an open source inventory management system for electronic components.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00348 Published 2026-10-23 Fixed in 2.12.1 CWE-434

TI-2026-79537 CVE-2026-54615

Stored cross-site scripting in Part-DB activity log Extra column

LOW 27

Part-DB is an open source inventory management system for electronic components.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00372 Published 2026-10-23 Fixed in 2.12.1 CWE-79

TI-2019-15485 CVE-2019-25432 · GHSA-2wwg-wcjv-q464

Part-DB 0.4 Authentication Bypass via login.php

HIGH 77

Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to login by injecting SQL syntax into authentication parameters.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00407 Published 2026-02-20 No fix listed CWE-89

TI-2025-34870 CVE-2025-55194

Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload

MEDIUM 59

Part-DB is an open source inventory management system for electronic components.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00393 Published 2025-08-13 Fixed in 1.17.3 CWE-248

TI-2023-11276 CVE-2023-26042

HTML/XSS injection possibilities in Part-DB

LOW 30

Part-DB is an open source inventory management system for your electronic components.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0051 Published 2023-02-27 Fixed in 1.0.2 CWE-79

TI-2022-00754 CVE-2022-0848 · GHSA-px7p-wv92-2466

OS Command Injection in part-db/part-db

HIGH 68

OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.35436 Published 2022-03-04 Fixed in 0.5.11 CWE-78

Vulnerabilities

Filters