CVE-2025-5007

Tuesday, May 20, 2025

5.1

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

A vulnerability was found in Part-DB up to 1.17.0. It has been declared as problematic. Affected by this vulnerability is the function handleUpload of the file src/Services/Attachments/AttachmentSubmitHandler.php of the component Profile Picture Feature. The manipulation of the argument attachment leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.17.1 is able to address this issue. The identifier of the patch is 2c4f44e808500db19c391159b30cb6142896d415. It is recommended to upgrade the affected component.

Affected Software

Vendor	Product	Version Range	Status
n/a	Part-DB	`1.0`	affected
n/a	Part-DB	`1.1`	affected
n/a	Part-DB	`1.2`	affected
n/a	Part-DB	`1.3`	affected
n/a	Part-DB	`1.4`	affected
n/a	Part-DB	`1.5`	affected
n/a	Part-DB	`1.6`	affected
n/a	Part-DB	`1.7`	affected
n/a	Part-DB	`1.8`	affected
n/a	Part-DB	`1.9`	affected
n/a	Part-DB	`1.10`	affected
n/a	Part-DB	`1.11`	affected
n/a	Part-DB	`1.12`	affected
n/a	Part-DB	`1.13`	affected
n/a	Part-DB	`1.14`	affected
n/a	Part-DB	`1.15`	affected
n/a	Part-DB	`1.16`	affected
n/a	Part-DB	`1.17.0`	affected

Weaknesses

CWE-79: Cross Site Scripting
CWE-94: Code Injection

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: no
- Technical Impact: partial

References

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.