GitHub Advisoryadvisory · Packagist

GHSA-fww5-m9wc-jcjc Snipe-IT is vulnerable to stored cross-site scripting

MEDIUM Published 2025-12-01 Modified 2025-12-04 Official page ↗
Aliases
CVE-2025-65621
Ecosystem
Packagist
Packages
snipe/snipe-it
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-269, CWE-79
Reviewed
2025-12-02

Affected packages

• Packagist snipe/snipe-it: < 8.3.4 → fixed in 8.3.4

Description

Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.

Related

Alias · CVE (1)

  • CVE-2025-65621 Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an… vulnerability

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References