CVE-2025-65622
Medium · 5.4CVSS
5.4
EPSS
0.2%
Published
Dec 1, 2025
CISA due date
—
The record
Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | snipe/snipe-it | 0 | 8.3.4 |
Related vulnerabilities
- GHSA-4g25-wj72-chxg Snipe-IT allows stored XSS via the Locations "Country" field Same vulnerability
- CVE-2025-15602 Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account… Also affects snipe/snipe-it
- GHSA-fww5-m9wc-jcjc Snipe-IT is vulnerable to stored cross-site scripting Also affects snipe/snipe-it
- CVE-2025-65621 Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to… Also affects snipe/snipe-it
- GHSA-8x9v-8qgj-945x Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow Also affects snipe/snipe-it
- CVE-2025-64027 Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow Also affects snipe/snipe-it
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79