Snipeitapp Snipe-It vulnerabilities

CVE-2021-4130 [HIGH] CWE-352 CVE-2021-4130: snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2022-2997 [HIGH] CWE-384 CVE-2022-2997: Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10. Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10.

CVE-2026-48493 [MEDIUM] CWE-863 CVE-2026-48493: Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only user Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only users.edit can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example `assets.view`, `assets.create`, `reports.view`, import, etc. The issue is patched in version 8.6.0.

CVE-2026-44833 [HIGH] CWE-601 CVE-2026-44833: Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1.

CVE-2022-0178 [MEDIUM] CWE-862 CVE-2022-0178: Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8.

CVE-2022-44381 [MEDIUM] CWE-203 CVE-2022-44381: Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.

CVE-2025-65622 [MEDIUM] CWE-79 CVE-2025-65622: Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session.

CVE-2025-65621 [MEDIUM] CWE-79 CVE-2025-65621: Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject Java Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.

CVE-2025-64027 [MEDIUM] CWE-79 CVE-2025-64027: Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the C Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/update request to inject arbitrary H

CVE-2019-10118 [MEDIUM] CWE-79 CVE-2019-10118: Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the A Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.

CVE-2022-1380 [MEDIUM] CWE-79 CVE-2022-1380: Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.

CVE-2022-1445 [MEDIUM] CWE-79 CVE-2022-1445: Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe/snipe-it prior to 5.4.3. The vulnerability is capable of stolen the user Cookie.

CVE-2026-44831 [MEDIUM] CWE-79 CVE-2026-44831: Snipe-IT is an IT asset/license management system. Prior to 8.4.1, users with component view access Snipe-IT is an IT asset/license management system. Prior to 8.4.1, users with component view access could be impacted by an unescaped notes column, resulting in cross-site scripting (XSS). This vulnerability is fixed in 8.4.1.

CVE-2022-32060 [MEDIUM] CWE-79 CVE-2022-32060: An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.

CVE-2022-32061 [MEDIUM] CWE-79 CVE-2022-32061: An arbitrary file upload vulnerability in the Select User function under the People Menu component o An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.

CVE-2021-4108 [MEDIUM] CWE-79 CVE-2021-4108: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site S snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-3863 [MEDIUM] CWE-79 CVE-2021-3863: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site S snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-3879 [MEDIUM] CWE-79 CVE-2021-3879: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site S snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-3961 [MEDIUM] CWE-79 CVE-2021-3961: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site S snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-4018 [MEDIUM] CWE-79 CVE-2021-4018: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site S snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')