These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
Part-DB, an open-source inventory management system for electronic components, is vulnerable to password reset link poisoning via host header injection. This issue allows an unauthenticated attacker to take over an account before authentication by manipulating the Host header to generate a reset link with an attacker-controlled hostname, thereby disclosing the genuine reset token.
Part-DB, an open-source inventory management system for electronic components, contains a spreadsheet formula injection vulnerability in its part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, which are then written to an XLSX spreadsheet without proper neutralization. If another user exports and opens the spreadsheet [truncated]
CVE-2026-86019 is a vulnerability in Part-DB, an open-source inventory management system for electronic components. The issue allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. This can potentially lead to a denial of service due to disk space exhaustion.
CVE-2026-86018 is a medium-severity vulnerability in Part-DB, an open-source inventory management system for electronic components. An authenticated user can cause a denial of service by bypassing the maximum attachment file size limit when using the server-side 'Download external file' attachment feature, potentially exhausting disk space. The issue has been patched in version 2.13.2.
Part-DB-server, an open-source inventory management system for electronic components, is vulnerable to stored cross-site scripting (XSS) due to improper sanitization of SVG files based on filename extensions rather than actual file content. An authenticated attacker can upload a malicious SVG file with a JavaScript payload using a non-SVG extension, which is then executed when any user views the attachmen [truncated]
Part-DB, an open-source inventory management system for electronic components, has a stored HTML injection vulnerability prior to version 2.12.2. The issue arises from the rendering of BOM validation information messages using Twig's |raw filter, which includes translated placeholders populated with user-controlled Part names. An attacker who can edit a Part name can store HTML markup in the Part name. Wh [truncated]
CVE-2026-54631 debrief: Part-DB, an open-source inventory management system, had a hardcoded APP_SECRET in its .env file, allowing attackers to forge remember-me cookies due to a hardcoded secret used as the HMAC key in Symfony. This issue enables fully authenticated sessions without credentials, potentially leading to unauthorized data access or modifications. The vulnerability was patched in version 2.1 [truncated]
CVE-2026-54630 debrief based on CVE Program and NVD records. Part-DB-server, an open-source inventory management system, is vulnerable to authenticated remote code execution (RCE) via .phar attachment upload served from public/media. The vulnerability exists because the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension. The e [truncated]
Part-DB, an open-source inventory management system for electronic components, has a stored XSS vulnerability in the activity-log Extra column. The vulnerability exists due to unsanitized CollectionElementDeleted element names in the LogEntryExtraFormatter. A low-privileged content editor can store an HTML/script payload as the name of a sub-element, delete it, and have that markup parsed as live DOM in t [truncated]