CVE-2025-64027

The IT asset management system Snipe-IT v8.3.4 (build 20218) is vulnerable to a reflected cross-site scripting (XSS) flaw in the CSV Import workflow. The root cause is the lack of sanitization for the progress_message value, which the application renders as raw HTML in the admin interface. An att...