Snipeitapp Snipe-it
71 CVEs affecting Snipeitapp Snipe-it. Latest disclosed: 2026-07-10. Critical: 2, High: 18.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-63601 | Critical | 9.9 | 2025-11-05 | Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing… |
CVE-2026-37709 | Critical | 9.8 | 2026-05-07 | Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute ar… |
CVE-2026-44832 | High | 8.8 | 2026-05-26 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to… |
CVE-2025-15602 | High | 8.8 | 2026-03-06 | Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An… |
CVE-2023-5511 | High | 8.8 | 2023-10-11 | Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3. |
CVE-2022-23064 | High | 8.8 | 2022-05-02 | In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, i… |
CVE-2021-4130 | High | 8.8 | 2021-12-18 | snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3858 | High | 8.8 | 2021-10-19 | snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2026-55466 | High | 8.7 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and Upload… |
CVE-2024-51093 | High | 8.7 | 2024-11-12 | Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. This can le… |
CVE-2026-54329 | High | 8.5 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while… |
CVE-2024-51094 | High | 8.0 | 2024-11-12 | An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. W… |
CVE-2022-2997 | High | 8.0 | 2022-08-25 | Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10. |
CVE-2026-55516 | High | 7.7 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance… |
CVE-2024-5685 | High | 7.6 | 2024-06-14 | Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call… |
CVE-2022-1155 | High | 7.4 | 2022-03-30 | Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10. |
CVE-2026-55452 | High | 7.3 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActiv… |
CVE-2021-4075 | High | 7.2 | 2021-12-06 | snipe-it is vulnerable to Server-Side Request Forgery (SSRF) |
CVE-2026-55460 | High | 7.1 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can… |
CVE-2026-48507 | High | 7.1 | 2026-06-08 | Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` pe… |