Part-DB

Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover

Part-DB: Spreadsheet Formula Injection in XLSX Part Exports

Part-DB: Attachment Size Limit Bypass via API Base64 Upload

Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads

Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer

Part-DB: Stored HTML injection in BOM validation results via unescaped Part name

Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie

Part-DB: Authenticated RCE via .phar attachment upload served from public/media

Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)

Part-DB 0.4 Authentication Bypass via login.php