CVE-2025-47226

CVE-2025-47226 - Snipe-IT = v8.0.4 中的 IDOR 漏洞 🚨 Snipe-IT 中的不安全直接对象引用（IDOR）漏洞允许经过身份验证的用户通过篡改 locationid 来查看其他部门的资产信息。 ✍️ 发现者 Siripong Jintung GitHub: Sn1p3r-H4ck3r Linkedin: www.linkedin.com/in/siripong-j-885b652b6 , 进攻性安全专家 | Movaci Co., Ltd. 📋 PoC 摘要 字段| 详情 ---|--- CVE ID| CVE-2025-47226 产品|...

CVE-2022-32060

Snipe-IT Version v6.0.2 Vulnerability Explanation: An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file. Attack Vectors: We found a vulnerability file upload, when we upload malicious file...

CVE-2025-15602-PoC

CVE-2025-15602-PoC CVE-2025-15602-PoC 是针对 Snipe-IT 中 CVE-2025-15602 漏洞的概念验证。 其中一个脚本用于列出所有用户，另一个脚本用于接管超级管理员账户。 背景 用户只有编辑用户的权限，他可以利用该权限列出所有用户，并实现对超级管理员账户的接管。 listusers.py 别忘了修改脚本中的 BASEURL，以匹配你的 snipe-it 实例。 列出实例中的所有用户，以获取你想接管的超级管理员的 id。 root@kitploit: python3 listusers.py --attacker-username...

CVE-2025-59712_CVE-2025-59713

CVE-2025-59712 和 CVE-2025-59713 的 PoC 该 PoC 提供了一个自动化脚本，用于利用 CVE-2025-59712（User-Agent 头中的 XSS）和 CVE-2025-59713（不安全的反序列化）。 背景 这两个漏洞是 Synacktiv 在对 Snipe-IT 软件进行漏洞研究时发现的。Snipe-IT 是一个基于 Laravel 的开源资产管理系统，旨在帮助组织跟踪和管理其物理和数字资产。 技术细节可在 Synacktiv 网站 上的专项安全公告中查看。 模式 脚本提供三个子命令，对应三种利用模式：xss、rce 和 fullchain。...

CVE-2026-88894

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

CVE-2026-88894

Snipe-IT , an IT asset management platform, contains an authorization bypass in its predefined kit checkout path. The root cause is that PredefinedKitCheckoutService never calls the tenant-isolation check ($item->canCheckoutTo($target)) that all other checkout paths enforce under Full Multiple...

EUVD-2026-75444

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

CVE-2026-88894 Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

CVE-2026-88894 Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

CVE-2025-64027

Product Info Snipe-IT is a free and open-source IT asset management system FOSS built on Laravel. It provides hardware asset tracking, software license management, accessories, and consumables inventory features for IT operations teams. It is actively maintained and updated frequently. Summary A...

PT-2026-89405

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, AppServicesPredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

CVE-2026-86773

Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...

CVE-2026-86774

Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission...

CVE-2026-86772

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject...

CVE-2026-86771

Snipe-IT versions before 8.7.0 fail to HTML-escape the employeenum field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML function. Attackers can craft a malicious employeenum value containing an img tag with an arbitrary HTT...

CVE-2026-86768

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted use...

CVE-2026-86767

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tena...

CVE-2026-86770

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4unicodeci database collation t...

CVE-2026-86769

Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the createdby column instead of the authenticated caller's id. Authenticated attackers with consumables.checkout permission...

CVE-2026-86763

Snipe-IT versions = 7.0.12 and = 8.6.3 contain an authorization bypass in the Livewire importer component App\Livewire\Importer, mounted at the imports.index route. The component only checked the broad 'import' ability at mount time, while its files and activeFile computed properties queried the...