GHSA-fww5-m9wc-jcjc
Medium · 5.4CVSS
5.4
EPSS
—
Published
Dec 1, 2025
CISA due date
—
The record
Snipe-IT is vulnerable to stored cross-site scripting
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | snipe/snipe-it | 0 | 8.3.4 |
Related vulnerabilities
- CVE-2025-65621 Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to… Same vulnerability
- CVE-2025-15602 Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account… Also affects snipe/snipe-it
- GHSA-4g25-wj72-chxg Snipe-IT allows stored XSS via the Locations "Country" field Also affects snipe/snipe-it
- CVE-2025-65622 Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a… Also affects snipe/snipe-it
- GHSA-8x9v-8qgj-945x Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow Also affects snipe/snipe-it
- CVE-2025-64027 Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow Also affects snipe/snipe-it
- CVE-2026-114658 Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability… CWE-269
- CVE-2026-53614 util-linux is a random collection of Linux utilities. CWE-269