CVE-2025-5007

216.73.217.86

· Published 20/05/2025 23:15 · Modified 21/05/2025 20:24

Labels: CVE-2025-5007 2025-05-20 CVE-2025-5007 CWE-79 [email protected]

Essential information

Published: 20/05/2025 23:15
Modified: 21/05/2025 20:24
Author: —
Creator: —
CVSS: 5.1 MEDIUM (v3) 5.1 MEDIUM (v4.0)
CISA KEV: No
CWE: —
CVSS vector: —

CVSS metrics

Description

A vulnerability was found in Part-DB up to 1.17.0. It has been declared as problematic. Affected by this vulnerability is the function handleUpload of the file src/Services/Attachments/AttachmentSubmitHandler.php of the component Profile Picture Feature. The manipulation of the argument attachment leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.17.1 is able to address this issue. The identifier of the patch is 2c4f44e808500db19c391159b30cb6142896d415. It is recommended to upgrade the affected component.

NVD status

Status: Awaiting Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
part-db / part-db	`cpe:2.3:a:part-db:part-db:<1.17.1:::::::*`