25 matches found
Snipe-IT has CSV formula injection in Activity Report export
Impact In Snipe-IT v8.6.1 and lower, Actionlog::logaction stores the request User-Agent header in useragent. That value is later included in the Activity Report CSV export by ReportsController::postActivityReport and written with plain fputcsv. A low-privileged authenticated user can set a...
GHSA-WHRX-MMGR-GPCF Snipe-IT has CSV formula injection in Activity Report export
Impact In Snipe-IT v8.6.1 and lower, Actionlog::logaction stores the request User-Agent header in useragent. That value is later included in the Activity Report CSV export by ReportsController::postActivityReport and written with plain fputcsv. A low-privileged authenticated user can set a...
CSV Injection
Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to CSV Injection through the postActivityReport process. An attacker can cause arbitrary formula execution in spreadsheet software by injecting a specially crafted User-Agent...
CVE-2026-55452
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction stores the request User-Agent header and ReportsController::postActivityReport writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a...
CVE-2026-55452
CVE-2026-55452 concerns Snipe-IT (IT asset/license management) where pre-8.5.0 builds store the User-Agent header via Actionlog::logaction() and export it in Activity Report CSV without formula escaping. This allows a low-privileged authenticated user to inject a formula-like payload that can exe...
CVE-2026-55452 Snipe-IT: CSV formula injection in Activity Report export
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction stores the request User-Agent header and ReportsController::postActivityReport writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a...
CVE-2026-55452 Snipe-IT: CSV formula injection in Activity Report export
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction stores the request User-Agent header and ReportsController::postActivityReport writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a...
CVE-2026-55452 Snipe-IT: CSV formula injection in Activity Report export
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction stores the request User-Agent header and ReportsController::postActivityReport writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a...
PT-2026-57283
Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.5.0 Description An issue exists where the Actionlog::logaction function stores the request User-Agent header, and the ReportsController::postActivityReport function writes this value to the Activity Report CSV...
CVE-2025-63743
Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated attacker with lowest privileges sufficient only to log in, to inject arbitrary JavaScript code via "Name" and "Surname" fields. The JavaScript code is execut...
CVE-2025-63743: Improper Neutralization of Input During Web Page Generation
Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated attacker with lowest privileges sufficient only to log in, to inject arbitrary JavaScript code via "Name" and "Surname" fields. The JavaScript code is execut...
CVE-2025-63743
Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated attacker with lowest privileges sufficient only to log in, to inject arbitrary JavaScript code via "Name" and "Surname" fields. The JavaScript code is execut...
CVE-2025-63743
Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated attacker with lowest privileges sufficient only to log in, to inject arbitrary JavaScript code via "Name" and "Surname" fields. The JavaScript code is execut...
CVE-2025-63743
Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated attacker with lowest privileges sufficient only to log in, to inject arbitrary JavaScript code via "Name" and "Surname" fields. The JavaScript code is execut...
CERTFR-2026-ACT-005
creationtimestamp| type| source ---|---|--- 2026-02-02 14:24:55+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3mdv2f55uwk26 2026-02-02 15:42:59+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3mdv6qqjhxb2m 2026-02-06 23:48:20+00:00| seen|...
EUVD-2012-5969
Malware in sbrugna...
EUVD-2022-7001
Malicious code in bioql PyPI...
CVE-2025-1461
creationtimestamp| type| source ---|---|--- 2025-05-28 18:24:14+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqat6suri5a2...
CVE-2018-8639
creationtimestamp| type| source ---|---|--- 2025-03-03 15:58:10+00:00| seen| https://feedsin.space/feed/CISAKevBot/items/3472167 2025-03-03 18:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2025-03-03 19:03:10+00:00| seen| https://bsky.app/profile/hackingne.ws/post/3ljinbdwlgm23...