GHSA-4g25-wj72-chxg
NoneCVSS
—
EPSS
—
Published
Dec 2, 2025
CISA due date
—
The record
Snipe-IT allows stored XSS via the Locations "Country" field
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | snipe/snipe-it | 0 | 8.3.4 |
Related vulnerabilities
- CVE-2025-65622 Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a… Same vulnerability
- CVE-2025-15602 Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account… Also affects snipe/snipe-it
- GHSA-fww5-m9wc-jcjc Snipe-IT is vulnerable to stored cross-site scripting Also affects snipe/snipe-it
- CVE-2025-65621 Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to… Also affects snipe/snipe-it
- GHSA-8x9v-8qgj-945x Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow Also affects snipe/snipe-it
- CVE-2025-64027 Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow Also affects snipe/snipe-it
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79