CVE-2025-5007

MEDIUM EPSS 18.4%
Published May 20, 20251y ago · Modified Jun 17, 20261w ago
5.1 CVSS 4.0
Medium
Find Similar
Published May 20, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

A vulnerability was found in Part-DB up to 1.17.0. It has been declared as problematic. Affected by this vulnerability is the function handleUpload of the file src/Services/Attachments/AttachmentSubmitHandler.php of the component Profile Picture Feature. The manipulation of the argument attachment leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.17.1 is able to address this issue. The identifier of the patch is 2c4f44e808500db19c391159b30cb6142896d415. It is recommended to upgrade the affected component.

CVSS Details

Base Score
5.1
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
18.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 2

CWE-79 Cross-site Scripting Injection
CWE-94 Improper Control of Generation of Code (Code Injection) Injection

References 6

  • github.com https://github.com/Part-DB/Part-DB-server/commit/2c4f44e808500db19c391159b30cb6142896d415
  • github.com https://github.com/Part-DB/Part-DB-server/releases/tag/v1.17.1
  • github.com https://github.com/b1d0ws/CVEs/blob/main/CVE-2025-XXXX.md
  • vuldb.com https://vuldb.com/?ctiid.309661
  • vuldb.com https://vuldb.com/?id.309661
  • vuldb.com https://vuldb.com/?submit.580323

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.