CVE-2025-47226

CVE-2025-47226 - Snipe-IT v8.0.4以下におけるIDOR脆弱性 🚨 Snipe-ITのInsecure Direct Object Reference IDOR脆弱性により、認証されたユーザーがlocationidを改ざんすることで他部門の資産情報を閲覧できる可能性があります。 ✍️ 発見者 Siripong Jintung GitHub: Sn1p3r-H4ck3r Linkedin: www.linkedin.com/in/siripong-j-885b652b6 , Offensive Security Specialist | Movaci Co.,...

CVE-2022-32060

Snipe-IT 版本 v6.0.2 漏洞说明： Snipe-IT v6.0.2 的更新品牌设置组件中存在任意文件上传漏洞，攻击者可通过构造的文件执行任意代码。 攻击向量： 我们发现了一个文件上传漏洞，当在更新品牌设置页面上传恶意文件时触发。 Payload： https://github.com/bypazs/GrimTheRipper/blob/main/GrimTheRipperTeam.svg 测试环境： 1. Snipe-IT 版本 v6.0.2 2. Google Chrome 版本 102.0.5005.61 官方构建 64位 受影响组件：...

CVE-2025-59712_CVE-2025-59713

CVE-2025-59712 和 CVE-2025-59713 的 PoC 该 PoC 提供了一个自动化脚本，用于利用 CVE-2025-59712（User-Agent 头中的 XSS）和 CVE-2025-59713（不安全的反序列化）。 背景 这两个漏洞是 Synacktiv 在对 Snipe-IT 软件进行漏洞研究时发现的。Snipe-IT 是一个基于 Laravel 的开源资产管理系统，旨在帮助组织跟踪和管理其物理和数字资产。 技术细节可在 Synacktiv 网站 上的专项安全公告中查看。 模式 脚本提供三个子命令，对应三种利用模式：xss、rce 和 fullchain。...

CVE-2025-64027

产品信息 Snipe-IT 是一个基于 Laravel 构建的免费开源 IT 资产管理系统（FOSS）。它为 IT 运维团队提供硬件资产追踪、软件许可证管理、配件和耗材库存管理等功能。该项目维护活跃且更新频繁。 摘要 Snipe-IT v8.3.4（build 202118） 的 CSV 导入流程中存在一个反射型跨站脚本（XSS）漏洞。当上传无效的 CSV 文件时，应用程序会返回一个 progressmessage 值，该值会在管理界面中以原始 HTML 形式渲染。攻击者可以拦截并修改 POST/livewire/update 请求，向 progressmessage 参数中注入任意...

CVE-2025-15602-PoC

CVE-2025-15602-PoC CVE-2025-15602-PoC 是针对 Snipe-IT 中 CVE-2025-15602 漏洞的概念验证。 其中一个脚本用于列出所有用户，另一个脚本用于接管超级管理员账户。 背景 用户只有编辑用户的权限，他可以利用该权限列出所有用户，并实现对超级管理员账户的接管。 listusers.py 别忘了修改脚本中的 BASEURL，以匹配你的 snipe-it 实例。 列出实例中的所有用户，以获取你想接管的超级管理员的 id。 root@kitploit: python3 listusers.py --attacker-username...

CVE-2026-88894

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

CVE-2026-88894

Snipe-IT , an IT asset management platform, contains an authorization bypass in its predefined kit checkout path. The root cause is that PredefinedKitCheckoutService never calls the tenant-isolation check ($item->canCheckoutTo($target)) that all other checkout paths enforce under Full Multiple...

EUVD-2026-75444

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

CVE-2026-88894 Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

CVE-2026-88894 Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

PT-2026-89405

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, AppServicesPredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

CVE-2026-86774

Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission...

CVE-2026-86773

Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...

CVE-2026-86771

Snipe-IT versions before 8.7.0 fail to HTML-escape the employeenum field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML function. Attackers can craft a malicious employeenum value containing an img tag with an arbitrary HTT...

CVE-2026-86772

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject...

CVE-2026-86768

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted use...

CVE-2026-86769

Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the createdby column instead of the authenticated caller's id. Authenticated attackers with consumables.checkout permission...

CVE-2026-86770

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4unicodeci database collation t...

CVE-2026-86767

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tena...

CVE-2026-86763

Snipe-IT versions = 7.0.12 and = 8.6.3 contain an authorization bypass in the Livewire importer component App\Livewire\Importer, mounted at the imports.index route. The component only checked the broad 'import' ability at mount time, while its files and activeFile computed properties queried the...