Approved changes feed: RSS · Atom
cpe:2.3:a:part-db_project:part-db:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Part Db Project (d5f08611-eaad-5e6d-8811-0932d9344b2a) |
|---|---|
| Product | Part Db (e66fd9ed-794b-5f32-afed-6ec68a1ef018) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/jbtronics/part-db |
purl2cpe | 2026-06-01 10:15:29.952600 |
pkg:github/part-db/part-db |
purl2cpe | 2026-06-01 10:15:29.952602 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-55194 |
vulnerable | 2026-06-08 07:33:14.345541 |
Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload
MEDIUM (5.7)
Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension (e.g., .jpg.txt), resulting in a persistent 500 Internal Server Error when attempting to view or edit that user’s profile. This makes the profile permanently inaccessible via the UI for both users and administrators, constituting a Denial of Service (DoS) within the user management interface. This issue has been patched in version 1.17.3.
Published: 2025-08-13T22:46:30.217Z
Updated: 2025-08-14T14:51:03.540Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-26042 |
vulnerable | 2026-06-08 05:57:37.906651 |
HTML/XSS injection possibilities in Part-DB
MEDIUM (6.1)
Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and external scripts so it is not possible to execute JavaScript code, unless in combination with other vulnerabilities. There are no workarounds, please upgrade to Pat-DB 1.0.2 or later.
Published: 2023-02-27T14:41:24.145Z
Updated: 2025-03-10T17:48:28.160Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0848 |
vulnerable | 2026-06-08 05:39:11.332543 |
OS Command Injection in part-db/part-db
CRITICAL (10)
OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11.
Published: 2022-03-04T08:25:10.000Z
Updated: 2024-08-02T23:40:04.503Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.