Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

snipe-it — Vulnerabilities & Security Advisories 92

All 92 CVE vulnerabilities found in snipe-it, with AI-generated Chinese analysis, references, and POCs.

This page covers vulnerability aggregation for Snipe-IT, an open-source asset management application developed by Snipe-IT LLC. It collects data related to common weakness types such as cross-site scripting, SQL injection, and path traversal vulnerabilities affecting this specific software product. The information presented spans from the initial public release of the software through to the most recent security advisories issued by the vendor or discovered by the security community. By consulting this resource, users can effectively track the historical advisory pattern of the vendor to assess their remediation speed and transparency. Additionally, researchers can use this data to better understand the specific implementation flaws and weakness classes that frequently arise in asset management tools. Users may also look up the complete vulnerability history of Snipe-IT to evaluate the long-term security posture of the application. This aggregated view aids in risk assessment and helps administrators prioritize updates based on the severity and prevalence of known issues. The content is organized to facilitate a clear understanding of how vulnerabilities have evolved in this product line over time. It serves as a neutral reference point for security analysts, developers, and IT professionals seeking factual data without speculative commentary. All entries are derived from official security notices and verified third-party reports.

Vendor: snipe

CVE ID Title CVSS Severity Published
CVE-2026-19579 Snipe-IT Checkout Request Cancellation IDOR CWE-639 5.4 Medium 2026-08-11
CVE-2026-55481 Snipe-IT: CSS Injection via `header_color` Setting CWE-79 - - 2026-07-10
CVE-2026-55475 Snipe-IT: Import created_by can be overwritten CWE-863 5.7 Medium 2026-07-10
CVE-2026-55469 Snipe-IT: Path traversal vulnerability via CSV import `image` field CWE-22 6.5 Medium 2026-07-10
CVE-2026-55461 Snipe-IT: Open Redirect After User Edit CWE-601 6.1 Medium 2026-07-10
CVE-2026-55479 Snipe-IT: Incorrect permission for legacy license checkin API CWE-863 - - 2026-07-10
CVE-2026-55452 Snipe-IT: CSV formula injection in Activity Report export CWE-1236 - - 2026-07-10
CVE-2026-55466 Snipe-IT: Stored XSS via inline-served attachment CWE-79 - - 2026-07-10
CVE-2026-55515 Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint CWE-639 5.0 Medium 2026-07-10
CVE-2026-55462 Snipe-IT: Authorization bypass on print inventory page CWE-863 4.3 Medium 2026-07-10
CVE-2026-55464 Snipe-IT: Stored XSS via Markdown custom field CWE-79 - - 2026-07-10
CVE-2026-55460 Snipe-IT: Authorization bypass on bulk editing users CWE-863 7.1 High 2026-07-10
CVE-2026-55472 Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation CWE-863 4.3 Medium 2026-07-10
CVE-2026-55476 Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter CWE-862 - - 2026-07-10
CVE-2026-55478 Snipe-IT: Missing object-level authorization in Kits API CWE-639 - - 2026-07-10
CVE-2026-55843 Snipe-IT: Improper Privilege Management CWE-269 - - 2026-07-10
CVE-2026-55516 Snipe-IT: Cross-company asset maintenance re-parenting via API update CWE-639 7.7 High 2026-07-10
CVE-2026-55474 Snipe-IT: Directory traversal in displaySig CWE-23 - - 2026-07-10
CVE-2026-54329 Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API CWE-862 8.5 High 2026-07-10
CVE-2026-48492 Snipe-IT's selectlist visibility is too permissive CWE-862 - - 2026-07-08
CVE-2026-55542 Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL CWE-862 - - 2026-07-08
CVE-2026-48493 Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment CWE-863 5.5 Medium 2026-06-23
CVE-2026-48507 Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users CWE-863 7.1 High 2026-06-08
CVE-2026-44833 Snipe-IT: Open redirect vulnerability CWE-601 5.9 Medium 2026-05-26
CVE-2026-44832 Snipe-IT: Privilege Escalation via API Permissions Assignment CWE-281 - - 2026-05-26
CVE-2026-44831 Snipe-IT: XSS vulnerability in component notes CWE-79 4.8 Medium 2026-05-26
CVE-2025-15602 Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation CWE-915 8.8 High 2026-03-06
CVE-2025-59713 Snipe-IT 代码问题漏洞 CWE-502 6.8 Medium 2025-09-19
CVE-2025-59712 Snipe-IT 跨站脚本漏洞 CWE-79 6.4 Medium 2025-09-19
CVE-2025-47226 Snipe-IT 安全漏洞 CWE-425 5.0 Medium 2025-05-02

All 92 known CVE vulnerabilities affecting snipe-it with full Chinese analysis, references, and POCs where available.