Partkeepr

partkeepr

Vendor: Partkeepr • 4 CVEs

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-30899 1Partkeepr 1Partkeepr Nov 21, 2024 Jun 8, 2022 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 A Cross Site Scripting vulnerabilty exists in PartKeepr 1.4.0 via the 'name' field in /api/part_categories.
CVE-2021-39390 1Partkeepr 1Partkeepr Nov 21, 2024 May 3, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Stored XSS in PartKeepr 1.4.0 Edit section in multiple api endpoints via name parameter.
CVE-2022-22702 1Partkeepr 1Partkeepr Nov 21, 2024 Jan 10, 2022 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 PartKeepr versions up to v1.4.0, in the functionality to upload attachments using a URL when creating a part does not validate that requests can be made to local ports, allowing an authenticated user to carry out SSRF at...Show more PartKeepr versions up to v1.4.0, in the functionality to upload attachments using a URL when creating a part does not validate that requests can be made to local ports, allowing an authenticated user to carry out SSRF attacks and port enumeration.Show less
CVE-2022-22701 1Partkeepr 1Partkeepr Nov 21, 2024 Jan 10, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 PartKeepr versions up to v1.4.0, loads attachments using a URL while creating a part and allows the use of the 'file://' URI scheme, allowing an authenticated user to read local files.