The flaw lies in the LogEntryExtraFormatter component, which builds HTML for the activity‑log "Extra" column. In the CollectionElementDeleted branch, the code string‑formats the old name of a deleted collection sub‑element without escaping it, creating a stored cross‑site‑scripting vulnerability. An attacker who can edit or delete a collection sub‑element can supply a malicious name, delete the element so the log entry is written, and then have the crafted markup rendered for any user who views the log or element history. This can lead to session hijacking, credential theft, or other malicious actions within the victim’s browser. The issue is mitigated by CSP policies that normally block inline JavaScript execution, but unless CSP is properly configured or the attacker uses other payloads, the stored payload still poses a risk.

All installations of Part‑DB server running a version earlier than 2.12.1 are impacted. The vulnerability is present in the core Part‑DB server code used to generate activity log entries. Users who possess edit rights to any collection sub‑element (parameter, attachment, lot, etc.) are required to create the malicious payload, and the deletion of that sub‑element triggers the storage of the payload.

The CVSS score of 6 indicates a moderate impact; the EPSS metric is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a legitimate session with edit privileges on the owning element, but once the payload is stored it automatically propagates to any user who accesses the log or history of the deleted element. Although Content Security Policies may block inline scripts under normal circumstances, the risk remains if CSP is misconfigured or if the attacker uses payloads that bypass CSP measures. Given the moderate severity, the potential for widespread impact, and the need for privileged access, the vulnerability should be considered a high priority for remediation.