Arbitrary File Upload

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Arbitrary File Upload via the snipeit:restore command. An attacker can execute arbitrary system commands by uploading a specially crafted backup file containing malicious...

CVE-2025-63601

Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands...

CVE-2025-63601

Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands...

CVE-2025-63601

Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands...

CVE-2025-63601

Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands...

CVE-2025-63601

CVE-2025-63601 affects Snipe-IT prior to 8.3.3. An authenticated attacker can upload a malicious backup file (via the backup/restore flow) containing arbitrary files and then execute system commands, yielding remote code execution. The vulnerability is described as a remote code execution with a ...

Snipe-IT 安全漏洞

Snipe-IT is an open source IT asset/license management system from Grokability Open Source. A security vulnerability exists in Snipe-IT versions prior to 8.3.3 that originates from allowing an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system...

EUVD-2025-37899

Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands...

PT-2025-45120

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.3.3 Description An authenticated attacker can execute system commands by uploading a malicious backup file containing arbitrary files. The issue is a remote code execution that allows for arbitrary file uploads and...

Deserialization Of Untrusted Data

Snipe-IT is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to improper handling of untrusted serialized data, which allows an attacker to supply malicious objects that can be deserialized to execute arbitrary code or manipulate application logic...

Cross-site Scripting (XSS)

Snipe-IT is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization of user-supplied input, which allows an attacker to inject and execute arbitrary web scripts in the context of a victim’s browser...

Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for October 2025.

Summary Security vulnerabilities are addressed with IBM Business Automation Insights 24.0.0-IF005 and 25.0.0-IF002. These vulnerabilities have been also addressed in 24.0.1-IF005. Vulnerability Details CVEID:CVE-2025-36091 DESCRIPTION: IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and...

Malicious Package

Overview new-route-matrix is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview xo-tracking is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Attack Surface Exposures: A Practical Guide

Many security teams believe their existing tools have them fully covered. With a firewall, endpoint protection, and a vulnerability scanner, it’s easy to assume you can see everything that matters. This is one of the most dangerous myths in cybersecurity today. These tools often operate in silos,...

A Practical Guide to Attack Surface Intelligence Mapping

Think of your organization’s digital presence as a sprawling, ever-expanding city. New buildings servers go up, old ones are forgotten, and unofficial shortcuts shadow IT appear overnight. Trying to defend this city without a current map is impossible. You’re left reacting to alarms instead of...

Malicious code in types-lodash.es (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ad198ed6efdd1d7367a198d4b5c761b7ecf5421158cf8cce424a4f693598f1f The package types-lodash.es was found to contain malicious code. Source: ghsa-malware cd47d05a7a2bdd9fbd2f267aaeb6664d79583714a396f493858e926e1cc25f0...

Cloud Attack Surface Management Mapping 101

Before an attacker launches an assault, they do their homework. Their first step is to meticulously map your digital footprint, searching for the path of least resistance—an exposed database, an unpatched server, or a forgotten subdomain. The reality is that your attack surface is already being...

Malicious code in unused-imports (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01031534d46574b4aca0e5341d43399ac25cf7c751f841cf6af2eec7b73fa797 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-43784

Missing Authorization vulnerability in epiphanyit321 Referral Link Tracker referral-link-tracker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Referral Link Tracker: from n/a through = 1.1.4...