CVE-2023-26042
- Source
- https://cve.org/CVERecord?id=CVE-2023-26042
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-26042.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-26042
- Aliases
-
- GHSA-9pmh-gmxx-rg2x
- Published
- 2023-02-27T14:41:24.145Z
- Modified
- 2026-04-02T08:51:15.978353Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- HTML/XSS injection possibilities in Part-DB
- Details
-
Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and external scripts so it is not possible to execute JavaScript code, unless in combination with other vulnerabilities. There are no workarounds, please upgrade to Pat-DB 1.0.2 or later.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26042.json", "cwe_ids": [ "CWE-79" ], "cna_assigner": "GitHub_M" }- References
-
- https://github.com/Part-DB/Part-DB-server/releases/tag/v1.0.2
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26042.json
- https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-9pmh-gmxx-rg2x
- https://nvd.nist.gov/vuln/detail/CVE-2023-26042
- https://github.com/Part-DB/Part-DB-server/commit/5b7f44f4eaacad8a79bcedec32780e00d7347099
- https://github.com/Part-DB/Part-DB-server/pull/227