CVE-2026-62368

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page...

CVE-2026-62368 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page...

CVE-2026-62368

The IT asset/license management system Snipe-IT is vulnerable to a Stored XSS flaw prior to version 8.7.0 . An attacker with customfields.create permissions can store malicious markup in the CustomField.name property. The application fails to escape this value when assigned as a bootstrap-table h...

CVE-2026-62368 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page...

EUVD-2026-86292

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page...

CVE-2026-62368 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page...

CVE-2026-62368: Improper Neutralization of Input During Web Page Generation

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page...

PT-2026-98143

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description A user with the customfields.create permission can store malicious markup in the CustomField.name variable. The app/Presenters/AssetPresenter.php file assigns this value as an unescaped...