Part-DB manages electronic components, storage locations, supplier records, and bills of materials. The data can be mundane inventory, and it can also reveal a product that has not been announced. A count-only ZoomEye query returned 0 application matches and 149 title matches on 2026-11-04. The title result is a place to start an ownership review.
Measurement scope
The application query was app="Part-DB" and the title query was title="Part-DB". Both used sub_type=all, page 1, and pagesize 1 at 07:49 Asia/Shanghai. The reported totals were 0 and 149. A zero product fingerprint does not mean the server software is absent from the internet. It means ZoomEye did not assign that application value in this query.
The Part-DB documentation describes a REST API and a user permission system. API tokens are created for a user, and the documentation says a token can have less authority than the user. The service also supports attachments and integration with engineering tools. Those features define the review surface: a token may read inventory without being able to change stock, and an attachment may contain a supplier drawing or a private file.
Map the public and private functions
An external catalog can be useful for a supplier or a distributed engineering team. A stock-adjustment interface, user administration page, and database configuration page do not need the same audience. Separate the routes with a reverse proxy or the application's own access controls. Require strong authentication and a second factor for administration where the deployment supports it.
Review the permission model by role, not only by user. A viewer should not be able to create parts, adjust stock, download a private attachment, or issue a token. Check that disabled users lose active tokens. Confirm that an API token's scope is visible to the person who owns it and to the administrator who audits it.
Protect the inventory record
Inventory data can be sensitive because it describes shortages, purchasing plans, and hardware in development. Attachments require malware scanning and a private storage volume. Backups should be encrypted and access-controlled. Export functions need an audit trail because a bulk export can move more information than any single page view.
Use the title count to build a short list of hosts. For each host, record the certificate organization, the page title, the observed redirect, and the owning team. If the host is owned, test an unauthenticated request, a read-only session, and an administrative session. If the host is not owned, keep it as a third-party lead rather than attempting intrusive access.
What the number means
The 149 matches are not a claim that 149 organizations exposed a vulnerable Part-DB service. They are surface observations. The absence of an application fingerprint also means some title matches may be documentation or referrals. The defensible conclusion is that a specialized inventory tool has a visible naming footprint and that its data deserves a permission review.
ZoomEye is useful here because the product is not a generic web server. A narrow title query can produce a reviewable population. The security work starts when an operator confirms the asset and inspects its actual authorization.
References
[2] Part-DB API authentication