CVE-2022-32060

Snipe-IT バージョン v6.0.2 脆弱性の説明: Snipe-IT v6.0.2 の「Update Branding Settings」コンポーネントにおける任意ファイルアップロードの脆弱性により、攻撃者は細工されたファイルを介して任意のコードを実行できます。 攻撃ベクトル: Update Branding Settings ページに悪意のあるファイルをアップロードした際に、ファイルアップロードの脆弱性を発見しました。 ペイロード : https://github.com/bypazs/GrimTheRipper/blob/main/GrimTheRipperTeam.svg...

CVE-2025-15602-PoC

CVE-2025-15602-PoC CVE-2025-15602-PoC は、Snipe-IT の脆弱性 CVE-2025-15602 に対する概念実証（PoC）です。 1つはすべてのユーザーを一覧表示するスクリプト、もう1つはスーパー管理者アカウントを乗っ取るスクリプトです。 Context ユーザー編集権限のみを持つユーザーが、その権限を悪用してユーザー一覧の取得やスーパー管理者アカウントの乗っ取りを行うことができます。 listusers.py スクリプト内の BASEURL を、お使いの snipe-it インスタンスに合わせて変更することを忘れないでください。...

CVE-2025-47226

CVE-2025-47226 - Snipe-IT v8.0.4以下におけるIDOR脆弱性 🚨 Snipe-ITのInsecure Direct Object Reference IDOR脆弱性により、認証されたユーザーがlocationidを改ざんすることで他部門の資産情報を閲覧できる可能性があります。 ✍️ 発見者 Siripong Jintung GitHub: Sn1p3r-H4ck3r Linkedin: www.linkedin.com/in/siripong-j-885b652b6 , Offensive Security Specialist | Movaci Co.,...

CVE-2025-59712_CVE-2025-59713

CVE-2025-59712 および CVE-2025-59713 の PoC この PoC は、CVE-2025-59712 User-Agent ヘッダーの XSS と CVE-2025-59713 安全でないデシリアライゼーション を悪用する自動化スクリプトを提供します。 背景 これら 2 つの脆弱性は、Snipe-IT ソフトウェアの脆弱性調査中に Synacktiv によって発見されました。Snipe-IT は Laravel ベースのオープンソース資産管理システムであり、組織が物理資産およびデジタル資産を追跡・管理するために設計されています。 技術的な解説は、Synackti...

CVE-2025-64027

製品情報 Snipe-IT は Laravel で構築されたフリーかつオープンソースの IT 資産管理システム（FOSS）です。IT 運用チーム向けに、ハードウェア資産の追跡、ソフトウェアライセンス管理、アクセサリ、消耗品の在庫管理機能を提供します。積極的にメンテナンスされ、頻繁に更新されています。 概要 Snipe-IT v8.3.4（build 202118） の CSV インポートワークフローに、反射型クロスサイトスクリプティング（XSS）の脆弱性が存在します。無効な CSV ファイルがアップロードされると、アプリケーションは progressmessage...

Cross-site Scripting (XSS)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the API's handling of uploaded XML files, which are rendered inline without proper sanitization. An attacker can execute arbitrary JavaScrip...

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Snipe-IT's uploaded-files API accepts XML documents and later serves them inline without applying the safe-inline allowlist used by the equivalent web controller. An authenticated user who can attach files to a supported object can upload an XSLT stylesheet and an XML document that references it...

GHSA-396X-XMVH-P563 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Snipe-IT's uploaded-files API accepts XML documents and later serves them inline without applying the safe-inline allowlist used by the equivalent web controller. An authenticated user who can attach files to a supported object can upload an XSLT stylesheet and an XML document that references it...

Cross-site Scripting (XSS)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the AssetPresenter process. An attacker can execute arbitrary scripts in the context of a higher-privileged user's session by injecting maliciou...

Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

Impact A user with the "customfields.create" permission can store HTML/JS in a Custom Field name, which is later rendered as an asset-list column title WITHOUT escaping at app/Presenters/AssetPresenter.php line 364 'title' = $field-name and injected into the table header by the bundled...

GHSA-P9H3-GVPQ-5539 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

Impact A user with the "customfields.create" permission can store HTML/JS in a Custom Field name, which is later rendered as an asset-list column title WITHOUT escaping at app/Presenters/AssetPresenter.php line 364 'title' = $field-name and injected into the table header by the bundled...

CVE-2026-63498

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/objecttype/id/files/fileid allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The...

CVE-2026-63493

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web...

CVE-2026-62368

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page...

CVE-2026-62368 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page...

CVE-2026-62368

The IT asset/license management system Snipe-IT is vulnerable to a Stored XSS flaw prior to version 8.7.0 . An attacker with customfields.create permissions can store malicious markup in the CustomField.name property. The application fails to escape this value when assigned as a bootstrap-table h...

EUVD-2026-86292

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page...

CVE-2026-62368 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page...

CVE-2026-62368 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page...

Snipe-IT: 2FA bypass via the API token flow

Impact An attacker who knows a victim's password fully bypasses that account's 2FA and obtains a persistent token with full API access as the user read and write across the user's permissions, including admin if the victim is an admin. The token is an API credential, not a web/UI session using it...