CVE-2025-5007

Part-DB up to 1.17.0 exposes a cross-site scripting (XSS) vulnerability in the Profile Picture Feature. The issue lies in handleUpload (src/Services/Attachments/AttachmentSubmitHandler.php) where the attachment argument can be manipulated to inject scripts. It can be exploited remotely and an exp...

CVE-2025-5007 Part-DB Profile Picture Feature AttachmentSubmitHandler.php handleUpload cross site scripting

A vulnerability was found in Part-DB up to 1.17.0. It has been declared as problematic. Affected by this vulnerability is the function handleUpload of the file src/Services/Attachments/AttachmentSubmitHandler.php of the component Profile Picture Feature. The manipulation of the argument attachmen...

PT-2025-22316 · Part-Db · Part-Db

Name of the Vulnerable Software and Affected Versions: Part-DB versions up to 1.17.0 Description: A vulnerability was found in the Profile Picture Feature of Part-DB, affecting the handleUpload function of the AttachmentSubmitHandler.php file. The manipulation of the attachment argument leads to...