CVE-2025-64027

Snipe-IT v8.3.4 (build 20218) contains a reflected XSS in the CSV Import workflow. Affected component is the CSV Import progress_message, which is rendered as raw HTML after uploading an invalid CSV. An attacker who can intercept/modify the POST /livewire/update request can inject arbitrary HTML/...