Security
فارسی
All products

snipe/snipe-it

Composer · Package
81 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
snipe-IT vulnerable to host header injectionCVE-2022-23064 · GHSA-9VH6-QFV6-VCQP snipe/snipe-it Composer High Fix reported
Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files APICVE-2026-63498 · GHSA-396X-XMVH-P563 snipe/snipe-it Composer High Fix reported
Snipe-IT: Stored XSS via Custom Field name in asset-list column headersCVE-2026-62368 · GHSA-P9H3-GVPQ-5539 snipe/snipe-it Composer High Fix reported
Snipe-IT: 2FA bypass via the API token flowCVE-2026-63493 · GHSA-HXCX-9H4F-42XX snipe/snipe-it Composer High Fix reported
Snipe-IT API Vulnerable to Cross-Tenant Accessory InjectionCVE-2026-54329 · GHSA-PWPJ-P52H-Q484 snipe/snipe-it Composer High Fix reported
Snipe-IT Vulnerable to User Account Escalation via CSV ImportCVE-2026-49976 · GHSA-P68W-RGMG-3C2V snipe/snipe-it Composer Medium Fix reported
Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL CVE-2026-55542 · GHSA-6MMJ-JHQJ-6C6Q snipe/snipe-it Composer Low Fix reported
Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`CVE-2026-49870 · GHSA-MR8G-2MJ4-PCQ2 snipe/snipe-it Composer Medium Fix reported
Snipe-IT has Multi-Tenancy Bypass via Bulk Asset UpdateCVE-2026-55482 · GHSA-33G4-646G-QWMM snipe/snipe-it Composer Medium Fix reported
Snipe-IT has an open redirect vulnerabilityCVE-2026-44833 · GHSA-MGHP-5CQ4-V6MG snipe/snipe-it Composer Medium Fix reported
Snipe-IT has Privilege Escalation via API Permissions AssignmentCVE-2026-44832 · GHSA-HQ28-CRG7-95PR snipe/snipe-it Composer High Fix reported
Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0)CVE-2026-44831 · GHSA-R42M-953Q-6VJX snipe/snipe-it Composer Medium Fix reported
Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User CreationCVE-2026-55483 · GHSA-HF68-G98V-WP9G snipe/snipe-it Composer Medium Fix reported
Snipe-IT's selectlist visibility is too permissiveCVE-2026-48492 · GHSA-F3C5-6CW8-FG57 snipe/snipe-it Composer Medium Fix reported
Snipe-IT has a 2FA reset privilege bypassCVE-2026-50550 · GHSA-6X4J-8954-5HXM snipe/snipe-it Composer Medium Fix reported
Snipe-IT has Improper Authorization in File Deletion (IDOR)CVE-2026-55519 · GHSA-X667-R589-43M7 snipe/snipe-it Composer Low Fix reported
Snipe-IT: Tenant Isolation Bypass in FMCS Floater ModeCVE-2026-55643 · GHSA-C6W2-J4WQ-MVWG snipe/snipe-it Composer High Fix reported
Snipe-IT has an Improper Privilege Management issueCVE-2026-55843 · GHSA-J5G3-42WP-GQM3 snipe/snipe-it Composer High Fix reported
Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API updateCVE-2026-55516 · GHSA-575R-357H-FHCH snipe/snipe-it Composer High Fix reported
Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpointCVE-2026-55515 · GHSA-35CR-9HQQ-P2MG snipe/snipe-it Composer Medium Fix reported