PA
Vendor
Part-DB
11
CVEs
0
On KEV
9
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-86055 New | PA Part-DB-server Part-DB | 8.7 | Oct 23 | Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover |
| CVE-2026-86020 New | PA Part-DB-server Part-DB | 4.6 | Oct 23 | Part-DB: Spreadsheet Formula Injection in XLSX Part Exports |
| CVE-2026-86019 New | PA Part-DB-server Part-DB | 5.3 | Oct 23 | Part-DB: Attachment Size Limit Bypass via API Base64 Upload |
| CVE-2026-86018 New | PA Part-DB-server Part-DB | 5.3 | Oct 23 | Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads |
| CVE-2026-59188 New | PA Part-DB-server Part-DB | 5.4 | Oct 23 | Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer |
| CVE-2026-55600 New | PA Part-DB-server Part-DB | 5.7 | Oct 23 | Part-DB: Stored HTML injection in BOM validation results via unescaped Part name |
| CVE-2026-54631 New | PA Part-DB-server Part-DB | 6.3 | Oct 23 | Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie |
| CVE-2026-54630 New | PA Part-DB-server Part-DB | 9.6 | Oct 23 | Part-DB: Authenticated RCE via .phar attachment upload served from public/media |
| CVE-2026-54615 New | PA Part-DB-server Part-DB | 6.0 | Oct 23 | Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap) |
| CVE-2019-25432 | PA Part-DB Part-DB | 7.5 | Feb 20 | Part-DB 0.4 Authentication Bypass via login.php |
| CVE-2025-55194 | PA Part-DB-server Part-DB | 5.7 | Aug 13 | Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload |