Snipeitapp Snipe-IT

Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands.

Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute arbitrary code via the app/Http/Controllers/Api/UploadedFilesController.php component

Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown

Snipe-IT before 8.7.0 CSS Injection via Custom CSS

Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback

Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it

Stored Cross Site Scripting vulnerability in the checked_out_to parameter in snipe/snipe-it

Snipe-IT - Host Header Injection

Missing Authorization in snipe/snipe-it

Cross-Site Request Forgery (CSRF) in snipe/snipe-it

Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation

Cross-Site Request Forgery (CSRF) in snipe/snipe-it

snipe-it before 8.6.3 Authorization Bypass via Bulk Delete

Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation

Snipe-IT: Privilege Escalation via API Permissions Assignment

Cross-Site Request Forgery (CSRF) in snipe/snipe-it

Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition

Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode

Snipe-IT: Stored XSS via inline-served attachment

Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. This can lead to privilege escalation when the payload is executed, granting the attacker super admin permissions within the Snipe-IT system.

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore

Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation

Snipe-IT before 8.7.0 Authentication Bypass via API Middleware

Snipe-IT: 2FA bypass via the API token flow

Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API

Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptance

Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA

Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients

Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

snipe-it before 8.7.0 Authorization Bypass via API User Create/Update

Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num

Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()

Broken Function Level Authorization (BFLA) in snipe/snipe-it

Snipe-IT before 8.1.18 allows unsafe deserialization.

Session Fixation in snipe/snipe-it

Cross-site Scripting (XSS) - Stored in snipe/snipe-it

An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be executed, allowing the attacker to exfiltrate internal system data from the CSV file to a remote server.

Snipe-IT: Cross-company asset maintenance re-parenting via API update

Old sessions are not blocked by the login enable function. in snipe/snipe-it