- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 81 · 3 critical, 18 high, 54 medium, 3 low
- Registry
- Packagist
Advisories 81
- CVE-2026-62368High 8.1
Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
Affected: fixed in 8.7.0.
- CVE-2026-63493High 8.6
Snipe-IT: 2FA bypass via the API token flow
Affected: fixed in 8.7.0.
- CVE-2026-63498High 8.7
Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
Affected: fixed in 8.7.0.
- CVE-2026-55694High 7.1
Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover
Affected: fixed in 8.6.3.
- CVE-2026-55643High 7.6
Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode
Affected: fixed in 8.6.3.
- CVE-2026-55703Medium 4.3
Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET
Affected: fixed in 8.6.3.
- CVE-2026-61807Medium 6.3
Snipe-IT: Stored DOM XSS via table selected-count IDs
Affected: fixed in 8.6.2.
- CVE-2026-55519Medium 5.4
Snipe-IT: Improper Authorization in File Deletion (IDOR)
Affected: fixed in 8.4.1.
- CVE-2026-55482Medium 6.3
Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update
Affected: fixed in 8.4.2.
- CVE-2026-55483Medium 4.9
Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation
Affected: fixed in 8.6.0.
- CVE-2026-50550Medium 5.8
Snipe-IT: 2FA reset privilege bypass
Affected: fixed in 8.5.0.
- CVE-2026-49870Medium 5.9
Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`
Affected: fixed in 8.6.0.
- CVE-2026-49976Medium 6.5
Snipe-IT: User Account Escalation via CSV Import
Affected: fixed in 8.6.0.
- CVE-2026-55481Medium 6.2
Snipe-IT: CSS Injection via `header_color` Setting
Affected: fixed in 8.6.2.
- CVE-2026-55475Medium 5.7
Snipe-IT: Import created_by can be overwritten
Affected: fixed in 8.6.1.
Show all 81 advisoriesShow fewer advisories
- CVE-2026-55469Medium 6.5
Snipe-IT: Path traversal vulnerability via CSV import `image` field
Affected: fixed in 8.6.2.
- CVE-2026-55461Medium 6.1
Snipe-IT: Open Redirect After User Edit
Affected: fixed in 8.6.2.
- CVE-2026-55479Medium 5.3
Snipe-IT: Incorrect permission for legacy license checkin API
Affected: fixed in 8.6.2.
- CVE-2026-55452Medium 4.8
Snipe-IT: CSV formula injection in Activity Report export
Affected: fixed in 8.6.2.
- CVE-2026-55466Medium 6.2
Snipe-IT: Stored XSS via inline-served attachment
Affected: fixed in 8.6.2.
- CVE-2026-55515Medium 5.0
Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint
Affected: fixed in 8.6.2.
- CVE-2026-55462Medium 4.3
Snipe-IT: Authorization bypass on print inventory page
Affected: fixed in 8.6.1.
- CVE-2026-55464Medium 4.8
Snipe-IT: Stored XSS via Markdown custom field
Affected: fixed in 8.6.2.
- CVE-2026-55460High 7.1
Snipe-IT: Authorization bypass on bulk editing users
Affected: fixed in 8.6.2.
- CVE-2026-55472Medium 4.3
Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation
Affected: fixed in 8.6.2.
- CVE-2026-55476Medium 5.3
Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter
Affected: fixed in 8.6.0.
- CVE-2026-55478Medium 5.3
Snipe-IT: Missing object-level authorization in Kits API
Affected: fixed in 8.6.2.
- CVE-2026-55843High 7.0
Snipe-IT: Improper Privilege Management
Affected: fixed in 8.6.0.
- CVE-2026-55516High 7.7
Snipe-IT: Cross-company asset maintenance re-parenting via API update
Affected: fixed in 8.6.2.
- CVE-2026-55474High 7.1
Snipe-IT: Directory traversal in displaySig
Affected: fixed in 8.5.0.
- CVE-2026-54329High 8.5
Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API
Affected: fixed in 8.6.2.
- CVE-2026-48492Medium 4.9
Snipe-IT's selectlist visibility is too permissive
Affected: fixed in 8.5.1.
- CVE-2026-55542Low 1.3
Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL
Affected: fixed in 8.5.1.
- CVE-2026-48493Medium 5.5
Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment
Affected: fixed in 8.6.0.
- CVE-2026-48507High 7.1
Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users
Affected: fixed in 8.6.0.
- CVE-2026-44833Medium 5.9
Snipe-IT: Open redirect vulnerability
Affected: fixed in 8.4.1.
- CVE-2026-44832High 8.7
Snipe-IT: Privilege Escalation via API Permissions Assignment
Affected: fixed in 8.4.1.
- CVE-2026-44831Medium 4.8
Snipe-IT: XSS vulnerability in component notes
Affected: fixed in 8.4.1.
- CVE-2026-37709Critical 9.8
Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote…
Affected: fixed in 8.4.1.
- CVE-2025-15602High 8.7
Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation
Affected: fixed in 8.3.7.
- CVE-2025-65622Medium 5.4
Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject…
Affected: fixed in 8.3.4.
- CVE-2025-65621Medium 5.4
Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an…
Affected: fixed in 8.3.4.
- CVE-2025-64027Medium 6.1
Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow.
Affected: through 8.3.4.
- CVE-2025-59713Medium 6.8
Snipe-IT before 8.1.18 allows unsafe deserialization.
Affected: fixed in 8.1.18.
- CVE-2025-59712Medium 6.4
Snipe-IT before 8.1.18 allows XSS.
Affected: fixed in 8.1.18.
- CVE-2025-47226Medium 5.0
Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.
Affected: fixed in 8.1.0.
- CVE-2024-51093High 8.7
Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing…
Affected: through 7.0.13.
- CVE-2024-48987Medium 6.6
Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY.
Affected: fixed in 7.0.10.
- CVE-2024-5685High 7.6
Broken Function Level Authorization (BFLA) in snipe/snipe-it
Affected: fixed in 6.4.2.
- CVE-2023-5511Medium 6.3
Cross-Site Request Forgery (CSRF) in snipe/snipe-it
Affected: fixed in 6.2.3.
- CVE-2023-5452Medium 5.5
Cross-site Scripting (XSS) - Stored in snipe/snipe-it
Affected: fixed in 6.2.2.
- CVE-2022-44381Medium 5.3
Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.
Affected: through 6.0.14.
- CVE-2022-44380Medium 5.4
Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.
Affected: fixed in 6.0.14.
- CVE-2022-3173Medium 4.3
Improper Authentication in snipe/snipe-it
Affected: fixed in 6.0.10.
- CVE-2022-3035Medium 5.9
Cross-site Scripting (XSS) - Stored in snipe/snipe-it
Affected: fixed in 6.0.11.
- CVE-2022-2997Medium 4.6
Session Fixation in snipe/snipe-it
Affected: fixed in 6.0.10.
- CVE-2022-32061Unrated
An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to…
Affected: through 6.0.2.
- CVE-2022-32060Unrated
An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary…
Affected: through 6.0.2.
- CVE-2022-23064High 8.8
Snipe-IT - Host Header Injection
Affected: from 3.0-alpha, fixed in 5.3.8.
- CVE-2022-1511Medium 6.5
Missing Authorization in snipe/snipe-it
Affected: fixed in 5.4.4.
- CVE-2022-1445Critical 9.0
Stored Cross Site Scripting vulnerability in the checked_out_to parameter in snipe/snipe-it
Affected: fixed in 5.4.3.
- CVE-2022-1380Critical 9.1
Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it
Affected: fixed in 5.4.3.
- CVE-2022-1155High 7.4
Old sessions are not blocked by the login enable function. in snipe/snipe-it
Affected: from 6.0.0-RC-1, fixed in 6.0.0-RC-6; fixed in 5.4.2.
- CVE-2022-0622Medium 5.3
Generation of Error Message Containing Sensitive Information in snipe/snipe-it
Affected: fixed in 5.3.11.
- CVE-2022-0611Medium 6.3
Missing Authorization in snipe/snipe-it
Affected: fixed in 5.3.11.
- CVE-2022-0579Medium 6.5
Missing Authorization in snipe/snipe-it
Affected: fixed in 5.3.9.
- CVE-2022-0569Medium 5.3
Observable Discrepancy in snipe/snipe-it
Affected: fixed in 5.3.10.
- CVE-2022-0178Medium 6.3
Missing Authorization in snipe/snipe-it
Affected: fixed in 5.3.8.
- CVE-2022-0179Medium 6.3
Missing Authorization in snipe/snipe-it
Affected: fixed in 5.3.7.
- CVE-2021-4130Medium 4.3
Cross-Site Request Forgery (CSRF) in snipe/snipe-it
Affected: fixed in 5.3.6.
- CVE-2021-4108Medium 6.4
Cross-site Scripting (XSS) - Stored in snipe/snipe-it
Affected: fixed in 5.3.5.
- CVE-2021-4089Medium 4.3
Improper Access Control in snipe/snipe-it
Affected: fixed in 5.3.4.
- CVE-2021-4075Low 2.7
Server-Side Request Forgery (SSRF) in snipe/snipe-it
Affected: fixed in 6.0.0-GM.
- CVE-2021-4018Medium 6.3
Cross-site Scripting (XSS) - Stored in snipe/snipe-it
Affected: fixed in 5.3.3.
- CVE-2021-3961High 8.0
Cross-site Scripting (XSS) - Stored in snipe/snipe-it
Affected: fixed in 5.3.2.
- CVE-2021-3931Medium 4.3
Cross-Site Request Forgery (CSRF) in snipe/snipe-it
Affected: through 5.3.1.
- CVE-2021-3938Low 3.9
Cross-site Scripting (XSS) - Generic in snipe/snipe-it
Affected: fixed in 5.4.0.
- CVE-2021-3879Medium 6.8
Cross-site Scripting (XSS) - Stored in snipe/snipe-it
Affected: fixed in 5.3.0.
- CVE-2021-3863Medium 5.5
Cross-site Scripting (XSS) - Generic in snipe/snipe-it
Affected: fixed in 5.3.0.
- CVE-2021-3858Medium 4.3
Cross-Site Request Forgery (CSRF) in snipe/snipe-it
Affected: fixed in 5.3.0.
- CVE-2019-10118Unrated
Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.
Affected: fixed in 4.6.14.