Stored Cross-Site Scripting Flaw in Part-DB Affects User Log Entries
CVE-2026-54615

6MEDIUM

Key Information:

Vendor

Part-db

Status
Part-db-server
Vendor
CVE Published:
23 October 2026

What is CVE-2026-54615?

A stored cross-site scripting (XSS) vulnerability exists in Part-DB prior to version 2.12.1, where insufficient input sanitization allows low-privileged users to inject HTML/script payloads into log entries. This can lead to unauthorized script execution in the browsers of higher-privileged users, compromising the integrity of user data and allowing for the potential exposure of sensitive information. The issue stems from a lapse in sanitization for specific log entry formats, impacting the security of the entire system. The vulnerability has been addressed in the latest release, prompting users to update to version 2.12.1 to ensure protection against such threats.

Affected Version(s)

Part-DB-server < 2.12.1

References

https://github.com/Part-DB/Part-DB-server/security/adviso...
x_refsource_CONFIRM
https://github.com/Part-DB/Part-DB-server/releases/tag/v2...
x_refsource_MISC

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.