Partkeepr: >> Partkeepr Security Vulnerabilities
A Cross Site Scripting vulnerabilty exists in PartKeepr 1.4.0 via the 'name' field in /api/part_categories.
CVSS Score
4.8
EPSS Score
0.002
Published
2022-06-08
Stored XSS in PartKeepr 1.4.0 Edit section in multiple api endpoints via name parameter.
CVSS Score
5.4
EPSS Score
0.002
Published
2022-05-03
PartKeepr versions up to v1.4.0, loads attachments using a URL while creating a part and allows the use of the 'file://' URI scheme, allowing an authenticated user to read local files.
CVSS Score
6.5
EPSS Score
0.002
Published
2022-01-10
PartKeepr versions up to v1.4.0, in the functionality to upload attachments using a URL when creating a part does not validate that requests can be made to local ports, allowing an authenticated user to carry out SSRF attacks and port enumeration.
CVSS Score
4.3
EPSS Score
0.001
Published
2022-01-10