Part-DB Part-DB-server vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20251
3. 20269

Newest CVEs

• CVE-2026-86055

  Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover

  Part-DB · Part-DB-server

  High8.7
• CVE-2026-86020

  Part-DB: Spreadsheet Formula Injection in XLSX Part Exports

  Part-DB · Part-DB-server

  Medium4.6
• CVE-2026-86019

  Part-DB: Attachment Size Limit Bypass via API Base64 Upload

  Part-DB · Part-DB-server

  Medium5.3
• CVE-2026-86018

  Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads

  Part-DB · Part-DB-server

  Medium5.3
• CVE-2026-59188

  Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer

  Part-DB · Part-DB-server

  Medium5.4
• CVE-2026-55600

  Part-DB: Stored HTML injection in BOM validation results via unescaped Part name

  Part-DB · Part-DB-server

  Medium5.7
• CVE-2026-54631

  Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie

  Part-DB · Part-DB-server

  Medium6.3
• CVE-2026-54630

  Part-DB: Authenticated RCE via .phar attachment upload served from public/media

  Part-DB · Part-DB-server

  Critical9.6
• CVE-2026-54615

  Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)

  Part-DB · Part-DB-server

  Medium6.0
• CVE-2025-55194

  Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload

  Part-DB · Part-DB-server

  Medium5.7