46 matches found
EUVD-2026-42999
Snipe-IT has an Open Redirect After User Edit...
PT-2026-57268
Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.0 Description An authenticated user can silently cancel pending asset requests of another user due to insufficient authorization. This occurs when the system processes the cancel by admin URL path segment in the...
GHSA-HF68-G98V-WP9G Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation
Impact The store method in both the web and API UsersController only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the users.create permission to create a new user with full admin privileges. Th...
GHSA-P68W-RGMG-3C2V Snipe-IT Vulnerable to User Account Escalation via CSV Import
Impact The CSV user import in update mode bypasses user-edit authorization. A user with only the import permission can overwrite any non-admin user's email by uploading a CSV, then trigger a password reset to take over the account. UserImporter.php checks the canEditAuthFields gate and tries to...
Allocation of Resources Without Limits or Throttling
Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the POST /two-factor process. An attacker can gain unauthorized access to user accounts by submitting unlimited TOTP...
PT-2026-51616
Name of the Vulnerable Software and Affected Versions Snipe-IT affected versions not specified Description An improper access control issue exists in the 'GET /api/v1/object/selectlist' API endpoint due to a missing authorization check. Any authenticated user, regardless of their assigned...
Snipe-IT 输入验证错误漏洞
Snipe-IT is a set of open-source IT asset/license management systems developed by Grokability. Versions of Snipe-IT prior to 8.4.1 contained a vulnerability related to input validation errors. This vulnerability stemmed from the unauthorized storage of HTTP Referer headers in session variables,...
Exploit for CVE-2025-15602
CVE-2025-15602-PoC CVE-2025-15602-PoC is a proof of concept f...
EUVD-2021-2162
Malware in sbrugna...
EUVD-2021-2332
Malware in sbrugna...
EUVD-2021-2448
Malware in sbrugna...
EUVD-2021-2203
Malware in sbrugna...
EUVD-2021-2585
Malware in sbrugna...
EUVD-2021-2297
Malware in sbrugna...
EUVD-2021-2184
Malware in sbrugna...
EUVD-2021-2278
Malware in sbrugna...
EUVD-2021-2498
Malware in sbrugna...
EUVD-2021-2443
Malware in sbrugna...