Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

snipe-it — Vulnerabilities & Security Advisories 31

All 31 CVE vulnerabilities found in snipe-it, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known vulnerabilities affecting Snipe-IT, an open-source asset management system, focusing on common weakness classifications. It collects a comprehensive list of security flaws, including remote code execution, cross-site scripting, and unauthorized access issues, covering data from the initial release up to the most recent advisories. By browsing this collection, users can efficiently track vendor advisories and patch cycles, gain a deeper understanding of specific weakness classes within the asset management domain, and review a detailed history of vulnerabilities associated with this product. The aggregation aims to provide security professionals and system administrators with a centralized resource for risk assessment and compliance checking. It highlights the evolution of security posture in Snipe-IT releases and identifies persistent architectural risks that may impact deployment environments. This information serves as a critical reference for evaluating the impact of specific CVEs on existing infrastructure and for prioritizing remediation efforts based on severity and exploitability. The data is structured to facilitate quick lookup of historical trends and current threat landscapes. Whether you are conducting a routine audit or responding to a new disclosure, this page offers the necessary context to make informed decisions about system hardening and update schedules. It does not provide technical exploitation details but rather focuses on the factual existence and classification of reported issues to support broader security governance activities.

Vendor: snipe

CVE IDTitleCVSSSeverityPublished
CVE-2026-55481 Snipe-IT: CSS Injection via `header_color` Setting CWE-79--2026-07-10
CVE-2026-55475 Snipe-IT: Import created_by can be overwritten CWE-863 5.7 Medium2026-07-10
CVE-2026-55469 Snipe-IT: Path traversal vulnerability via CSV import `image` field CWE-22 6.5 Medium2026-07-10
CVE-2026-55461 Snipe-IT: Open Redirect After User Edit CWE-601 6.1 Medium2026-07-10
CVE-2026-55479 Snipe-IT: Incorrect permission for legacy license checkin API CWE-863--2026-07-10
CVE-2026-55452 Snipe-IT: CSV formula injection in Activity Report export CWE-1236--2026-07-10
CVE-2026-55466 Snipe-IT: Stored XSS via inline-served attachment CWE-79--2026-07-10
CVE-2026-55515 Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint CWE-639 5.0 Medium2026-07-10
CVE-2026-55462 Snipe-IT: Authorization bypass on print inventory page CWE-863 4.3 Medium2026-07-10
CVE-2026-55464 Snipe-IT: Stored XSS via Markdown custom field CWE-79--2026-07-10
CVE-2026-55460 Snipe-IT: Authorization bypass on bulk editing users CWE-863 7.1 High2026-07-10
CVE-2026-55472 Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation CWE-863 4.3 Medium2026-07-10
CVE-2026-55476 Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter CWE-862--2026-07-10
CVE-2026-55478 Snipe-IT: Missing object-level authorization in Kits API CWE-639--2026-07-10
CVE-2026-55843 Snipe-IT: Improper Privilege Management CWE-269--2026-07-10
CVE-2026-55516 Snipe-IT: Cross-company asset maintenance re-parenting via API update CWE-639 7.7 High2026-07-10
CVE-2026-55474 Snipe-IT: Directory traversal in displaySig CWE-23--2026-07-10
CVE-2026-54329 Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API CWE-862 8.5 High2026-07-10
CVE-2026-48492 Snipe-IT's selectlist visibility is too permissive CWE-862--2026-07-08
CVE-2026-55542 Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL CWE-862--2026-07-08
CVE-2026-48493 Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment CWE-863 5.5 Medium2026-06-23
CVE-2026-48507 Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users CWE-863 7.1 High2026-06-08
CVE-2026-44833 Snipe-IT: Open redirect vulnerability CWE-601 5.9 Medium2026-05-26
CVE-2026-44832 Snipe-IT: Privilege Escalation via API Permissions Assignment CWE-281--2026-05-26
CVE-2026-44831 Snipe-IT: XSS vulnerability in component notes CWE-79 4.8 Medium2026-05-26
CVE-2025-15602 Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation CWE-915 8.8 High2026-03-06
CVE-2025-59713 Snipe-IT 代码问题漏洞 CWE-502 6.8 Medium2025-09-19
CVE-2025-59712 Snipe-IT 跨站脚本漏洞 CWE-79 6.4 Medium2025-09-19
CVE-2025-47226 Snipe-IT 安全漏洞 CWE-425 5.0 Medium2025-05-02
CVE-2024-5685 Broken Function Level Authorization (BFLA) in snipe/snipe-it CWE-862 7.6 High2024-06-14

All 31 known CVE vulnerabilities affecting snipe-it with full Chinese analysis, references, and POCs where available.