Part-DB-server.

Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover

• Part-DB-server
• CWE-640

Part-DB: Spreadsheet Formula Injection in XLSX Part Exports

• Part-DB-server
• Other injection
• CWE-20

Part-DB: Attachment Size Limit Bypass via API Base64 Upload

• Part-DB-server
• Denial of service

Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads

• Part-DB-server
• Denial of service

Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer

• Part-DB-server
• Cross-site scripting (XSS)
• Unrestricted file upload

Part-DB: Stored HTML injection in BOM validation results via unescaped Part name

• Part-DB-server
• Cross-site scripting (XSS)

Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie

• Part-DB-server
• Hard-coded credentials

Part-DB: Authenticated RCE via .phar attachment upload served from public/media

• Part-DB-server
• Unrestricted file upload

Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)

• Part-DB-server
• Cross-site scripting (XSS)

Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload

• Part-DB-server
• CWE-248

HTML/XSS injection possibilities in Part-DB

• Part-DB-server
• Cross-site scripting (XSS)