{"url":"http://public2.vulnerablecode.io/api/packages/538694?format=json","purl":"pkg:composer/snipe/snipe-it@4.7.5","type":"composer","namespace":"snipe","name":"snipe-it","version":"4.7.5","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"8.4.1","latest_non_vulnerable_version":"8.4.1","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/46184?format=json","vulnerability_id":"VCID-16y9-smp1-nfaa","summary":"Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-5511","reference_id":"","reference_type":"","scores":[{"value":"0.00113","scoring_system":"epss","scoring_elements":"0.29464","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00113","scoring_system":"epss","scoring_elements":"0.29445","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00113","scoring_system":"epss","scoring_elements":"0.29431","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00113","scoring_system":"epss","scoring_elements":"0.29535","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00113","scoring_system":"epss","scoring_elements":"0.29497","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-5511"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/6d55d782806c9660e9e65dc5250faacb5d0033ed","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-18T15:11:33Z/"}],"url":"https://github.com/snipe/snipe-it/commit/6d55d782806c9660e9e65dc5250faacb5d0033ed"},{"reference_url":"https://huntr.dev/bounties/43206801-9862-48da-b379-e55e341d78bf","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-18T15:11:33Z/"}],"url":"https://huntr.dev/bounties/43206801-9862-48da-b379-e55e341d78bf"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5511","reference_id":"CVE-2023-5511","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5511"},{"reference_url":"https://github.com/advisories/GHSA-33vj-r6p6-x4p8","reference_id":"GHSA-33vj-r6p6-x4p8","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-33vj-r6p6-x4p8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67310?format=json","purl":"pkg:composer/snipe/snipe-it@6.2.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@6.2.3"}],"aliases":["CVE-2023-5511","GHSA-33vj-r6p6-x4p8"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-16y9-smp1-nfaa"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/50736?format=json","vulnerability_id":"VCID-1d8d-19xp-9qdz","summary":"Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment\nSnipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-15602","reference_id":"","reference_type":"","scores":[{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08637","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08627","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.0859","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.0864","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08657","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-15602"},{"reference_url":"https://github.com/grokability/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/grokability/snipe-it"},{"reference_url":"https://github.com/grokability/snipe-it/releases/tag/v8.3.7","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-09T15:12:04Z/"}],"url":"https://github.com/grokability/snipe-it/releases/tag/v8.3.7"},{"reference_url":"https://snipeitapp.com","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://snipeitapp.com"},{"reference_url":"https://www.vulncheck.com/advisories/snipe-it-mass-assignment-vulnerability-leading-to-privilege-escalation","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-09T15:12:04Z/"}],"url":"https://www.vulncheck.com/advisories/snipe-it-mass-assignment-vulnerability-leading-to-privilege-escalation"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15602","reference_id":"CVE-2025-15602","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15602"},{"reference_url":"https://github.com/advisories/GHSA-5448-v74m-7mv7","reference_id":"GHSA-5448-v74m-7mv7","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-5448-v74m-7mv7"},{"reference_url":"https://snipeitapp.com/","reference_id":"snipeitapp.com","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-09T15:12:04Z/"}],"url":"https://snipeitapp.com/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/74520?format=json","purl":"pkg:composer/snipe/snipe-it@8.3.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-xk24-e9d1-4bd8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@8.3.7"}],"aliases":["CVE-2025-15602","GHSA-5448-v74m-7mv7"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-1d8d-19xp-9qdz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/41792?format=json","vulnerability_id":"VCID-1dda-mx1c-efa7","summary":"snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-4018","reference_id":"","reference_type":"","scores":[{"value":"0.00225","scoring_system":"epss","scoring_elements":"0.4525","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00225","scoring_system":"epss","scoring_elements":"0.4529","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00225","scoring_system":"epss","scoring_elements":"0.45277","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00225","scoring_system":"epss","scoring_elements":"0.45304","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00225","scoring_system":"epss","scoring_elements":"0.45323","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00225","scoring_system":"epss","scoring_elements":"0.45319","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-4018"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/ff81e6d5366c2cfb15618793ad919ae4cbb3ac57","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/ff81e6d5366c2cfb15618793ad919ae4cbb3ac57"},{"reference_url":"https://github.com/snipe/snipe-it/releases/tag/v5.3.3","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/releases/tag/v5.3.3"},{"reference_url":"https://huntr.dev/bounties/c14395f6-bf0d-4b06-b4d1-b509d8a99b54","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/c14395f6-bf0d-4b06-b4d1-b509d8a99b54"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4018","reference_id":"CVE-2021-4018","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4018"},{"reference_url":"https://github.com/advisories/GHSA-5fh3-25xr-g85h","reference_id":"GHSA-5fh3-25xr-g85h","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-5fh3-25xr-g85h"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59695?format=json","purl":"pkg:composer/snipe/snipe-it@5.3.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-21zs-gaq3-77a4"},{"vulnerability":"VCID-2akh-m243-mufc"},{"vulnerability":"VCID-3xtm-ufqd-zfe4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-5yd4-b352-mkbn"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6ujw-nug2-zbfr"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-dx3k-jtmy-audv"},{"vulnerability":"VCID-em3j-ax33-hbdh"},{"vulnerability":"VCID-en96-ata4-x3fu"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-jz6q-q8r7-tfhb"},{"vulnerability":"VCID-kp2t-jpsa-abds"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-nfxe-yksb-5fdt"},{"vulnerability":"VCID-qzjd-vr1m-43be"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xk8e-jc78-rkbt"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-ye2e-dsae-4fc8"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.3.3"}],"aliases":["CVE-2021-4018","GHSA-5fh3-25xr-g85h"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-1dda-mx1c-efa7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/42806?format=json","vulnerability_id":"VCID-21zs-gaq3-77a4","summary":"Business Logic Error\nOld sessions are not blocked by the login enable function in GitHub repository snipe/snipe-it prior to 5.3.10.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-1155","reference_id":"","reference_type":"","scores":[{"value":"0.00254","scoring_system":"epss","scoring_elements":"0.48876","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00254","scoring_system":"epss","scoring_elements":"0.48913","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00254","scoring_system":"epss","scoring_elements":"0.48898","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00254","scoring_system":"epss","scoring_elements":"0.48927","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00254","scoring_system":"epss","scoring_elements":"0.48946","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00254","scoring_system":"epss","scoring_elements":"0.48937","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-1155"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/bdabbbd4e98e88ee01e728ceb4fd512661fbd38d","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/bdabbbd4e98e88ee01e728ceb4fd512661fbd38d"},{"reference_url":"https://github.com/snipe/snipe-it/pull/10876","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/pull/10876"},{"reference_url":"https://github.com/snipe/snipe-it/releases/tag/v5.4.2","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/releases/tag/v5.4.2"},{"reference_url":"https://github.com/snipe/snipe-it/releases/tag/v6.0.0-RC-6","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/releases/tag/v6.0.0-RC-6"},{"reference_url":"https://huntr.dev/bounties/ebc26354-2414-4f72-88aa-f044aec2b2e1","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/ebc26354-2414-4f72-88aa-f044aec2b2e1"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1155","reference_id":"CVE-2022-1155","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1155"},{"reference_url":"https://github.com/advisories/GHSA-636j-7x7r-gvw2","reference_id":"GHSA-636j-7x7r-gvw2","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-636j-7x7r-gvw2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60677?format=json","purl":"pkg:composer/snipe/snipe-it@5.3.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-3xtm-ufqd-zfe4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-em3j-ax33-hbdh"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-jz6q-q8r7-tfhb"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-nfxe-yksb-5fdt"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.3.10"},{"url":"http://public2.vulnerablecode.io/api/packages/148435?format=json","purl":"pkg:composer/snipe/snipe-it@5.4.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-3xtm-ufqd-zfe4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-jz6q-q8r7-tfhb"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.4.2"},{"url":"http://public2.vulnerablecode.io/api/packages/148434?format=json","purl":"pkg:composer/snipe/snipe-it@6.0.0-RC-6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@6.0.0-RC-6"}],"aliases":["CVE-2022-1155","GHSA-636j-7x7r-gvw2"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-21zs-gaq3-77a4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/41811?format=json","vulnerability_id":"VCID-2akh-m243-mufc","summary":"snipe-it is vulnerable to Server-Side Request Forgery (SSRF)","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-4075","reference_id":"","reference_type":"","scores":[{"value":"0.00274","scoring_system":"epss","scoring_elements":"0.51067","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00274","scoring_system":"epss","scoring_elements":"0.51101","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00274","scoring_system":"epss","scoring_elements":"0.51082","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00274","scoring_system":"epss","scoring_elements":"0.51112","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00274","scoring_system":"epss","scoring_elements":"0.51134","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00274","scoring_system":"epss","scoring_elements":"0.51128","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-4075"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/4612b9e711b3ff5d2bcddbec5b18866d25f8e34e","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/4612b9e711b3ff5d2bcddbec5b18866d25f8e34e"},{"reference_url":"https://huntr.dev/bounties/4386fd8b-8c80-42bb-87b8-b506c46597de","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/4386fd8b-8c80-42bb-87b8-b506c46597de"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4075","reference_id":"CVE-2021-4075","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4075"},{"reference_url":"https://github.com/advisories/GHSA-553q-hpvp-q8pc","reference_id":"GHSA-553q-hpvp-q8pc","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-553q-hpvp-q8pc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/141305?format=json","purl":"pkg:composer/snipe/snipe-it@6.0.0-GM","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@6.0.0-GM"}],"aliases":["CVE-2021-4075","GHSA-553q-hpvp-q8pc"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2akh-m243-mufc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/41609?format=json","vulnerability_id":"VCID-3vbe-y1my-qqgj","summary":"snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-3858","reference_id":"","reference_type":"","scores":[{"value":"0.00154","scoring_system":"epss","scoring_elements":"0.35825","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00154","scoring_system":"epss","scoring_elements":"0.35865","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00154","scoring_system":"epss","scoring_elements":"0.35849","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00154","scoring_system":"epss","scoring_elements":"0.3589","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00154","scoring_system":"epss","scoring_elements":"0.35931","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00154","scoring_system":"epss","scoring_elements":"0.35921","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-3858"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/84c73aae5dcafa9529ceeeda6e8cdda5a42129c3","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/84c73aae5dcafa9529ceeeda6e8cdda5a42129c3"},{"reference_url":"https://github.com/snipe/snipe-it/releases/tag/v5.3.0","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/releases/tag/v5.3.0"},{"reference_url":"https://huntr.dev/bounties/a2fac2eb-100d-45b1-9ac7-71847c2f2b6b","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/a2fac2eb-100d-45b1-9ac7-71847c2f2b6b"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3858","reference_id":"CVE-2021-3858","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3858"},{"reference_url":"https://github.com/advisories/GHSA-g92x-8m54-p89v","reference_id":"GHSA-g92x-8m54-p89v","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-g92x-8m54-p89v"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/140527?format=json","purl":"pkg:composer/snipe/snipe-it@5.3.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-1dda-mx1c-efa7"},{"vulnerability":"VCID-21zs-gaq3-77a4"},{"vulnerability":"VCID-2akh-m243-mufc"},{"vulnerability":"VCID-3xtm-ufqd-zfe4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-5yd4-b352-mkbn"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6ujw-nug2-zbfr"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-cb8w-cdv2-b3a7"},{"vulnerability":"VCID-dx3k-jtmy-audv"},{"vulnerability":"VCID-em3j-ax33-hbdh"},{"vulnerability":"VCID-en96-ata4-x3fu"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-jz6q-q8r7-tfhb"},{"vulnerability":"VCID-k283-n11p-nba1"},{"vulnerability":"VCID-kp2t-jpsa-abds"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-nfxe-yksb-5fdt"},{"vulnerability":"VCID-qzjd-vr1m-43be"},{"vulnerability":"VCID-r18v-762e-xqha"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xk8e-jc78-rkbt"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-ye2e-dsae-4fc8"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.3.0"}],"aliases":["CVE-2021-3858","GHSA-g92x-8m54-p89v"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3vbe-y1my-qqgj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/43006?format=json","vulnerability_id":"VCID-3xtm-ufqd-zfe4","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nStored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe/snipe-it prior to 5.4.3. The vulnerability is capable of stolen the user Cookie.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-1445","reference_id":"","reference_type":"","scores":[{"value":"0.0033","scoring_system":"epss","scoring_elements":"0.56214","published_at":"2026-06-04T12:55:00Z"},{"value":"0.0033","scoring_system":"epss","scoring_elements":"0.56265","published_at":"2026-06-09T12:55:00Z"},{"value":"0.0033","scoring_system":"epss","scoring_elements":"0.56246","published_at":"2026-06-08T12:55:00Z"},{"value":"0.0033","scoring_system":"epss","scoring_elements":"0.56262","published_at":"2026-06-07T12:55:00Z"},{"value":"0.0033","scoring_system":"epss","scoring_elements":"0.56275","published_at":"2026-06-06T12:55:00Z"},{"value":"0.0033","scoring_system":"epss","scoring_elements":"0.56269","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-1445"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/f623d05d0c3487ae24c4f13907e4709484e5bf41","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/f623d05d0c3487ae24c4f13907e4709484e5bf41"},{"reference_url":"https://huntr.dev/bounties/f4420149-5236-4051-a458-5d4f1d5b7abd","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/f4420149-5236-4051-a458-5d4f1d5b7abd"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1445","reference_id":"CVE-2022-1445","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1445"},{"reference_url":"https://github.com/advisories/GHSA-hpx4-xjp7-m4vr","reference_id":"GHSA-hpx4-xjp7-m4vr","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hpx4-xjp7-m4vr"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61406?format=json","purl":"pkg:composer/snipe/snipe-it@5.4.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.4.3"}],"aliases":["CVE-2022-1445","GHSA-hpx4-xjp7-m4vr"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3xtm-ufqd-zfe4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/56167?format=json","vulnerability_id":"VCID-5cbq-47qe-gya8","summary":"Cross Site Scripting vulnerability in Snipe-IT v.7.0.13 allows a remote attacker to escalate privileges via an unknown part of the file /users/{{user-id}}/#files.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-51093","reference_id":"","reference_type":"","scores":[{"value":"0.00307","scoring_system":"epss","scoring_elements":"0.54236","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00307","scoring_system":"epss","scoring_elements":"0.54235","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00307","scoring_system":"epss","scoring_elements":"0.54213","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00307","scoring_system":"epss","scoring_elements":"0.54237","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00307","scoring_system":"epss","scoring_elements":"0.54246","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-51093"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"8.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://gist.githubusercontent.com/Tommywarren/ca70f1c43f4ec34dc19cd13459535780/raw/d13192ae50bc7c024b922412dfa3f530faa8d5db/CVE-2024-51093","reference_id":"CVE-2024-51093","reference_type":"","scores":[{"value":"8.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-11-21T18:08:52Z/"}],"url":"https://gist.githubusercontent.com/Tommywarren/ca70f1c43f4ec34dc19cd13459535780/raw/d13192ae50bc7c024b922412dfa3f530faa8d5db/CVE-2024-51093"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51093","reference_id":"CVE-2024-51093","reference_type":"","scores":[{"value":"8.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51093"},{"reference_url":"https://github.com/advisories/GHSA-hw9x-8m75-4vjq","reference_id":"GHSA-hw9x-8m75-4vjq","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hw9x-8m75-4vjq"}],"fixed_packages":[],"aliases":["CVE-2024-51093","GHSA-hw9x-8m75-4vjq"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5cbq-47qe-gya8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/41915?format=json","vulnerability_id":"VCID-5yd4-b352-mkbn","summary":"snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-4130","reference_id":"","reference_type":"","scores":[{"value":"0.00158","scoring_system":"epss","scoring_elements":"0.36322","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00158","scoring_system":"epss","scoring_elements":"0.36424","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00158","scoring_system":"epss","scoring_elements":"0.36415","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00158","scoring_system":"epss","scoring_elements":"0.36361","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00158","scoring_system":"epss","scoring_elements":"0.3635","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00158","scoring_system":"epss","scoring_elements":"0.36386","published_at":"2026-06-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-4130"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/9b2dd6522f214a3fbee6a4e32699104d0ea2b6ae","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/9b2dd6522f214a3fbee6a4e32699104d0ea2b6ae"},{"reference_url":"https://huntr.dev/bounties/ccf073cd-7f54-4d51-89f2-6b4a2e4ae81e","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/ccf073cd-7f54-4d51-89f2-6b4a2e4ae81e"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4130","reference_id":"CVE-2021-4130","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4130"},{"reference_url":"https://github.com/advisories/GHSA-4w23-c97g-fq5v","reference_id":"GHSA-4w23-c97g-fq5v","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-4w23-c97g-fq5v"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59879?format=json","purl":"pkg:composer/snipe/snipe-it@5.3.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-21zs-gaq3-77a4"},{"vulnerability":"VCID-3xtm-ufqd-zfe4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-dx3k-jtmy-audv"},{"vulnerability":"VCID-em3j-ax33-hbdh"},{"vulnerability":"VCID-en96-ata4-x3fu"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-jz6q-q8r7-tfhb"},{"vulnerability":"VCID-kp2t-jpsa-abds"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-nfxe-yksb-5fdt"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xk8e-jc78-rkbt"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-ye2e-dsae-4fc8"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.3.6"}],"aliases":["CVE-2021-4130","GHSA-4w23-c97g-fq5v"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5yd4-b352-mkbn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/92155?format=json","vulnerability_id":"VCID-6qb4-an9b-aufh","summary":"Snipe-IT has an open redirect vulnerability\nOpen redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable.\n\n### Impact\n\n-   **Phishing**: Redirect users to fake login pages to steal credentials\n-   **Session Hijacking**: Redirect to attacker site that captures session cookies via JavaScript\n-   **Malware Distribution**: Redirect to sites hosting malware or drive-by downloads\n-   **Reputation Damage**: Users lose trust when redirected to malicious sites from legitimate application\n-   **Social Engineering**: Use trusted Snipe-IT domain to increase phishing success rate\n\nWhen the user clicks \"Save\", the application: \n1. Processes the form \n2. Checks `redirect_option` (if set to 'back') \n3. Calls `Helper::getRedirectOption()` \n4. Retrieves `back_url` from session: `https://evil.com/phishing?target=snipeit` \n5. Executes `redirect()->to($backUrl)` \n6. User is redirected to attacker's site\n\nThis would still require session poisoning, so the actual practical threat here is minimal. \n\n### Patches\nPatched in https://github.com/grokability/snipe-it/commit/e37649212861a337e68a624e589c3540b7a82373, released in 8.4.1.\n\n### Workarounds\n None.\n\n### Resources\n-   CWE-601: URL Redirection to Untrusted Site ('Open Redirect')\n-   OWASP: Unvalidated Redirects and Forwards\n-   Laravel Security: Safe Redirects\n\n[snipeit_open_redirect_submission.md](https://github.com/user-attachments/files/27414869/snipeit_open_redirect_submission.md)","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-44833","reference_id":"","reference_type":"","scores":[{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.0209","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02114","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02121","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02109","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02097","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-44833"},{"reference_url":"https://github.com/grokability/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/grokability/snipe-it"},{"reference_url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-mghp-5cq4-v6mg","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T14:20:51Z/"}],"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-mghp-5cq4-v6mg"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44833","reference_id":"CVE-2026-44833","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44833"},{"reference_url":"https://github.com/grokability/snipe-it/commit/e37649212861a337e68a624e589c3540b7a82373","reference_id":"e37649212861a337e68a624e589c3540b7a82373","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T14:20:51Z/"}],"url":"https://github.com/grokability/snipe-it/commit/e37649212861a337e68a624e589c3540b7a82373"},{"reference_url":"https://github.com/advisories/GHSA-mghp-5cq4-v6mg","reference_id":"GHSA-mghp-5cq4-v6mg","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mghp-5cq4-v6mg"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/114739?format=json","purl":"pkg:composer/snipe/snipe-it@8.4.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@8.4.1"}],"aliases":["CVE-2026-44833","GHSA-mghp-5cq4-v6mg"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6qb4-an9b-aufh"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/41867?format=json","vulnerability_id":"VCID-6ujw-nug2-zbfr","summary":"snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-4108","reference_id":"","reference_type":"","scores":[{"value":"0.00225","scoring_system":"epss","scoring_elements":"0.45349","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00225","scoring_system":"epss","scoring_elements":"0.45389","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00225","scoring_system":"epss","scoring_elements":"0.45376","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00225","scoring_system":"epss","scoring_elements":"0.45402","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00225","scoring_system":"epss","scoring_elements":"0.45422","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00225","scoring_system":"epss","scoring_elements":"0.45418","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-4108"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"6.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/9d5d1a9f9aae2c8baee48551185da5de0cdb62c2","reference_id":"","reference_type":"","scores":[{"value":"6.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/9d5d1a9f9aae2c8baee48551185da5de0cdb62c2"},{"reference_url":"https://huntr.dev/bounties/5069a037-040e-4d77-8526-846e65edfaf4","reference_id":"","reference_type":"","scores":[{"value":"6.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/5069a037-040e-4d77-8526-846e65edfaf4"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4108","reference_id":"CVE-2021-4108","reference_type":"","scores":[{"value":"6.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4108"},{"reference_url":"https://github.com/advisories/GHSA-rxch-gp62-574w","reference_id":"GHSA-rxch-gp62-574w","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rxch-gp62-574w"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59815?format=json","purl":"pkg:composer/snipe/snipe-it@5.3.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-21zs-gaq3-77a4"},{"vulnerability":"VCID-3xtm-ufqd-zfe4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-5yd4-b352-mkbn"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-dx3k-jtmy-audv"},{"vulnerability":"VCID-em3j-ax33-hbdh"},{"vulnerability":"VCID-en96-ata4-x3fu"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-jz6q-q8r7-tfhb"},{"vulnerability":"VCID-kp2t-jpsa-abds"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-nfxe-yksb-5fdt"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xk8e-jc78-rkbt"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-ye2e-dsae-4fc8"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.3.5"}],"aliases":["CVE-2021-4108","GHSA-rxch-gp62-574w"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6ujw-nug2-zbfr"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/92149?format=json","vulnerability_id":"VCID-6wam-dqsj-e3dv","summary":"Snipe-IT has Privilege Escalation via API Permissions Assignment\n### Impact\nAn authenticated user with only `users.edit` permission can escalate their own privileges to `admin` by sending a PATCH request to `/api/v1/users/{id}` with `permissions[admin]=1`. The API controller only strips the `superuser` key from the permissions array, allowing `admin` and all other permission keys to be set by any user who can update users.\n\n### Patches\nPatched in https://github.com/grokability/snipe-it/commit/ce18ff669ceb0f0349749fd5d11c1d3d40b10569, fix was released in v8.4.1\n\n### Workarounds\nNone.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-44832","reference_id":"","reference_type":"","scores":[{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.0257","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02665","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02673","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02619","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02603","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-44832"},{"reference_url":"https://github.com/grokability/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/grokability/snipe-it"},{"reference_url":"https://github.com/grokability/snipe-it/commit/ce18ff669ceb0f0349749fd5d11c1d3d40b10569","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-27T14:05:22Z/"}],"url":"https://github.com/grokability/snipe-it/commit/ce18ff669ceb0f0349749fd5d11c1d3d40b10569"},{"reference_url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-hq28-crg7-95pr","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-27T14:05:22Z/"}],"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-hq28-crg7-95pr"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44832","reference_id":"CVE-2026-44832","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44832"},{"reference_url":"https://github.com/advisories/GHSA-hq28-crg7-95pr","reference_id":"GHSA-hq28-crg7-95pr","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hq28-crg7-95pr"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/114739?format=json","purl":"pkg:composer/snipe/snipe-it@8.4.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@8.4.1"}],"aliases":["CVE-2026-44832","GHSA-hq28-crg7-95pr"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6wam-dqsj-e3dv"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47821?format=json","vulnerability_id":"VCID-6xuf-y113-3qh1","summary":"Snipe-IT allows XSS\nSnipe-IT before 8.1.18 allows XSS.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-59712","reference_id":"","reference_type":"","scores":[{"value":"0.00011","scoring_system":"epss","scoring_elements":"0.01584","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00011","scoring_system":"epss","scoring_elements":"0.0158","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00011","scoring_system":"epss","scoring_elements":"0.01583","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00011","scoring_system":"epss","scoring_elements":"0.0159","published_at":"2026-06-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-59712"},{"reference_url":"https://github.com/grokability/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"6.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/grokability/snipe-it"},{"reference_url":"https://github.com/grokability/snipe-it/releases/tag/v8.1.18","reference_id":"","reference_type":"","scores":[{"value":"6.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-19T13:49:48Z/"}],"url":"https://github.com/grokability/snipe-it/releases/tag/v8.1.18"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59712","reference_id":"CVE-2025-59712","reference_type":"","scores":[{"value":"6.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59712"},{"reference_url":"https://github.com/advisories/GHSA-c9wp-pr7f-hfqm","reference_id":"GHSA-c9wp-pr7f-hfqm","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-c9wp-pr7f-hfqm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/70569?format=json","purl":"pkg:composer/snipe/snipe-it@8.1.18","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-xk24-e9d1-4bd8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@8.1.18"}],"aliases":["CVE-2025-59712","GHSA-c9wp-pr7f-hfqm"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6xuf-y113-3qh1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/109252?format=json","vulnerability_id":"VCID-91vw-khmf-6bbm","summary":"Snipe-IT vulnerable to Improper Authentication\nSnipe-IT prior to 6.0.10 is vulnerable to Improper Authentication. A user without the `View and Modify License Files` permission may access files uploaded to licenses as long as they have the `View` permission for licenses.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-3173","reference_id":"","reference_type":"","scores":[{"value":"0.00185","scoring_system":"epss","scoring_elements":"0.4012","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00185","scoring_system":"epss","scoring_elements":"0.40205","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00185","scoring_system":"epss","scoring_elements":"0.40202","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00185","scoring_system":"epss","scoring_elements":"0.40163","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00185","scoring_system":"epss","scoring_elements":"0.40148","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00185","scoring_system":"epss","scoring_elements":"0.40177","published_at":"2026-06-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-3173"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/dcab1381e7ee0b7fd1df3a34750dbff4b79185b2","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/dcab1381e7ee0b7fd1df3a34750dbff4b79185b2"},{"reference_url":"https://huntr.dev/bounties/6d8ffcc6-c6e3-4385-8ead-bdbbbacf79e9","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/6d8ffcc6-c6e3-4385-8ead-bdbbbacf79e9"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3173","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3173"},{"reference_url":"https://github.com/advisories/GHSA-fhvv-p968-6vvj","reference_id":"GHSA-fhvv-p968-6vvj","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-fhvv-p968-6vvj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/146075?format=json","purl":"pkg:composer/snipe/snipe-it@6.0.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@6.0.10"}],"aliases":["CVE-2022-3173","GHSA-fhvv-p968-6vvj"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-91vw-khmf-6bbm"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47818?format=json","vulnerability_id":"VCID-9uf7-64th-4kb9","summary":"Snipe-IT allows unsafe deserialization\nSnipe-IT before 8.1.18 allows unsafe deserialization.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-59713","reference_id":"","reference_type":"","scores":[{"value":"0.00039","scoring_system":"epss","scoring_elements":"0.12022","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00039","scoring_system":"epss","scoring_elements":"0.11919","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00039","scoring_system":"epss","scoring_elements":"0.11909","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00039","scoring_system":"epss","scoring_elements":"0.12026","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00039","scoring_system":"epss","scoring_elements":"0.11983","published_at":"2026-06-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-59713"},{"reference_url":"https://github.com/grokability/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/grokability/snipe-it"},{"reference_url":"https://github.com/grokability/snipe-it/releases/tag/v8.1.18","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-09-19T13:49:18Z/"}],"url":"https://github.com/grokability/snipe-it/releases/tag/v8.1.18"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59713","reference_id":"CVE-2025-59713","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59713"},{"reference_url":"https://github.com/advisories/GHSA-phwj-fgch-xvrj","reference_id":"GHSA-phwj-fgch-xvrj","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-phwj-fgch-xvrj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/70569?format=json","purl":"pkg:composer/snipe/snipe-it@8.1.18","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-xk24-e9d1-4bd8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@8.1.18"}],"aliases":["CVE-2025-59713","GHSA-phwj-fgch-xvrj"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9uf7-64th-4kb9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/46158?format=json","vulnerability_id":"VCID-acwy-5nbp-yyb4","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-5452","reference_id":"","reference_type":"","scores":[{"value":"0.00115","scoring_system":"epss","scoring_elements":"0.29759","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00115","scoring_system":"epss","scoring_elements":"0.29771","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00115","scoring_system":"epss","scoring_elements":"0.29793","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00115","scoring_system":"epss","scoring_elements":"0.29825","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00115","scoring_system":"epss","scoring_elements":"0.29862","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-5452"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/eea2eabaeef16fc8f3a1d61b19c06e9fc8ed942a","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"},{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-19T14:16:22Z/"}],"url":"https://github.com/snipe/snipe-it/commit/eea2eabaeef16fc8f3a1d61b19c06e9fc8ed942a"},{"reference_url":"https://huntr.dev/bounties/d6ed5ac1-2ad6-45fd-9492-979820bf60c8","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"},{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-19T14:16:22Z/"}],"url":"https://huntr.dev/bounties/d6ed5ac1-2ad6-45fd-9492-979820bf60c8"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5452","reference_id":"CVE-2023-5452","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5452"},{"reference_url":"https://github.com/advisories/GHSA-rr5c-69c9-gj9f","reference_id":"GHSA-rr5c-69c9-gj9f","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rr5c-69c9-gj9f"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67194?format=json","purl":"pkg:composer/snipe/snipe-it@6.2.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@6.2.2"}],"aliases":["CVE-2023-5452","GHSA-rr5c-69c9-gj9f"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-acwy-5nbp-yyb4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/41610?format=json","vulnerability_id":"VCID-ax2b-jba4-4ufg","summary":"snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-3879","reference_id":"","reference_type":"","scores":[{"value":"0.00453","scoring_system":"epss","scoring_elements":"0.64108","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00453","scoring_system":"epss","scoring_elements":"0.64157","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00453","scoring_system":"epss","scoring_elements":"0.64137","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00453","scoring_system":"epss","scoring_elements":"0.64149","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00453","scoring_system":"epss","scoring_elements":"0.6416","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00453","scoring_system":"epss","scoring_elements":"0.64152","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-3879"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/bda23bb1e66fd7ce42c75c69cf5eea4e80865c1c","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/bda23bb1e66fd7ce42c75c69cf5eea4e80865c1c"},{"reference_url":"https://huntr.dev/bounties/6dccc49e-3843-4a4a-b397-5c659e5f8bfe","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/6dccc49e-3843-4a4a-b397-5c659e5f8bfe"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3879","reference_id":"CVE-2021-3879","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3879"},{"reference_url":"https://github.com/advisories/GHSA-9g3v-j3cr-6fc6","reference_id":"GHSA-9g3v-j3cr-6fc6","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-9g3v-j3cr-6fc6"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/140527?format=json","purl":"pkg:composer/snipe/snipe-it@5.3.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-1dda-mx1c-efa7"},{"vulnerability":"VCID-21zs-gaq3-77a4"},{"vulnerability":"VCID-2akh-m243-mufc"},{"vulnerability":"VCID-3xtm-ufqd-zfe4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-5yd4-b352-mkbn"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6ujw-nug2-zbfr"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-cb8w-cdv2-b3a7"},{"vulnerability":"VCID-dx3k-jtmy-audv"},{"vulnerability":"VCID-em3j-ax33-hbdh"},{"vulnerability":"VCID-en96-ata4-x3fu"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-jz6q-q8r7-tfhb"},{"vulnerability":"VCID-k283-n11p-nba1"},{"vulnerability":"VCID-kp2t-jpsa-abds"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-nfxe-yksb-5fdt"},{"vulnerability":"VCID-qzjd-vr1m-43be"},{"vulnerability":"VCID-r18v-762e-xqha"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xk8e-jc78-rkbt"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-ye2e-dsae-4fc8"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.3.0"}],"aliases":["CVE-2021-3879","GHSA-9g3v-j3cr-6fc6"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ax2b-jba4-4ufg"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/49303?format=json","vulnerability_id":"VCID-bkce-dwzp-yqda","summary":"Snipe-IT allows stored XSS via the Locations \"Country\" field\nSnipe-IT before 8.3.4 allows stored XSS via the Locations \"Country\" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-65622","reference_id":"","reference_type":"","scores":[{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.0769","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07658","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07644","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07703","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07715","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-65622"},{"reference_url":"https://github.com/grokability/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/grokability/snipe-it"},{"reference_url":"https://github.com/grokability/snipe-it/commit/23feb64b5ab3d92eb8755da41049ac43a3d0e05b","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/grokability/snipe-it/commit/23feb64b5ab3d92eb8755da41049ac43a3d0e05b"},{"reference_url":"https://github.com/grokability/snipe-it/releases/tag/v8.3.4","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/grokability/snipe-it/releases/tag/v8.3.4"},{"reference_url":"http://snipeitapp.com","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T16:37:13Z/"}],"url":"http://snipeitapp.com"},{"reference_url":"https://github.com/firef0x00/vulnerability-research/tree/main/CVE-2025-65622","reference_id":"CVE-2025-65622","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T16:37:13Z/"}],"url":"https://github.com/firef0x00/vulnerability-research/tree/main/CVE-2025-65622"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65622","reference_id":"CVE-2025-65622","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65622"},{"reference_url":"https://github.com/advisories/GHSA-4g25-wj72-chxg","reference_id":"GHSA-4g25-wj72-chxg","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-4g25-wj72-chxg"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/71477?format=json","purl":"pkg:composer/snipe/snipe-it@8.3.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-xk24-e9d1-4bd8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@8.3.4"}],"aliases":["CVE-2025-65622","GHSA-4g25-wj72-chxg"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-bkce-dwzp-yqda"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/49284?format=json","vulnerability_id":"VCID-bpnp-1u65-zuc5","summary":"Snipe-IT is vulnerable to stored cross-site scripting\nSnipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-65621","reference_id":"","reference_type":"","scores":[{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06925","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06917","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06955","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06968","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06963","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-65621"},{"reference_url":"https://github.com/grokability/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"5.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/grokability/snipe-it"},{"reference_url":"https://github.com/grokability/snipe-it/releases/tag/v8.3.4","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"5.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/grokability/snipe-it/releases/tag/v8.3.4"},{"reference_url":"http://snipeitapp.com","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"5.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T14:34:04Z/"}],"url":"http://snipeitapp.com"},{"reference_url":"https://github.com/firef0x00/vulnerability-research/tree/main/CVE-2025-65621","reference_id":"CVE-2025-65621","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"5.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T14:34:04Z/"}],"url":"https://github.com/firef0x00/vulnerability-research/tree/main/CVE-2025-65621"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65621","reference_id":"CVE-2025-65621","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"5.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65621"},{"reference_url":"https://github.com/advisories/GHSA-fww5-m9wc-jcjc","reference_id":"GHSA-fww5-m9wc-jcjc","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-fww5-m9wc-jcjc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/71477?format=json","purl":"pkg:composer/snipe/snipe-it@8.3.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-xk24-e9d1-4bd8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@8.3.4"}],"aliases":["CVE-2025-65621","GHSA-fww5-m9wc-jcjc"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-bpnp-1u65-zuc5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/48433?format=json","vulnerability_id":"VCID-c5ff-jcx2-8qef","summary":"Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow\nSnipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/update request to inject arbitrary HTML or JavaScript into the progress_message. Because the server accepts the modified input without sanitization and reflects it back to the user, arbitrary JavaScript executes in the browser of any authenticated admin who views the import page.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-64027","reference_id":"","reference_type":"","scores":[{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.0213","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02111","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02117","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02134","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02141","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-64027"},{"reference_url":"https://github.com/grokability/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"5.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-20T21:37:16Z/"}],"url":"https://github.com/grokability/snipe-it"},{"reference_url":"https://github.com/cybercrewinc/CVE-2025-64027","reference_id":"CVE-2025-64027","reference_type":"","scores":[{"value":"5.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/cybercrewinc/CVE-2025-64027"},{"reference_url":"https://github.com/cybercrewinc/CVE-2025-64027/","reference_id":"CVE-2025-64027","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-20T21:37:16Z/"}],"url":"https://github.com/cybercrewinc/CVE-2025-64027/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64027","reference_id":"CVE-2025-64027","reference_type":"","scores":[{"value":"5.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64027"},{"reference_url":"https://github.com/advisories/GHSA-8x9v-8qgj-945x","reference_id":"GHSA-8x9v-8qgj-945x","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8x9v-8qgj-945x"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/903716?format=json","purl":"pkg:composer/snipe/snipe-it@8.3.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-xk24-e9d1-4bd8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@8.3.5"}],"aliases":["CVE-2025-64027","GHSA-8x9v-8qgj-945x"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-c5ff-jcx2-8qef"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/41736?format=json","vulnerability_id":"VCID-cb8w-cdv2-b3a7","summary":"snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-3961","reference_id":"","reference_type":"","scores":[{"value":"0.00326","scoring_system":"epss","scoring_elements":"0.55886","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00326","scoring_system":"epss","scoring_elements":"0.55833","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00326","scoring_system":"epss","scoring_elements":"0.5589","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00326","scoring_system":"epss","scoring_elements":"0.55896","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00326","scoring_system":"epss","scoring_elements":"0.55883","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00326","scoring_system":"epss","scoring_elements":"0.55866","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-3961"},{"reference_url":"https://github.com/snipe/snipe-it/commit/7ce5993f5ae9d713a0955c2fd8e2dff7a7ce886e","reference_id":"","reference_type":"","scores":[{"value":"8.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/7ce5993f5ae9d713a0955c2fd8e2dff7a7ce886e"},{"reference_url":"https://huntr.dev/bounties/5987aed5-6613-4937-8a3e-d48009b7da10","reference_id":"","reference_type":"","scores":[{"value":"8.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/5987aed5-6613-4937-8a3e-d48009b7da10"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3961","reference_id":"CVE-2021-3961","reference_type":"","scores":[{"value":"8.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3961"},{"reference_url":"https://github.com/advisories/GHSA-c65v-p733-9796","reference_id":"GHSA-c65v-p733-9796","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-c65v-p733-9796"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59605?format=json","purl":"pkg:composer/snipe/snipe-it@5.3.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-1dda-mx1c-efa7"},{"vulnerability":"VCID-21zs-gaq3-77a4"},{"vulnerability":"VCID-2akh-m243-mufc"},{"vulnerability":"VCID-3xtm-ufqd-zfe4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-5yd4-b352-mkbn"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6ujw-nug2-zbfr"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-dx3k-jtmy-audv"},{"vulnerability":"VCID-em3j-ax33-hbdh"},{"vulnerability":"VCID-en96-ata4-x3fu"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-jz6q-q8r7-tfhb"},{"vulnerability":"VCID-kp2t-jpsa-abds"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-nfxe-yksb-5fdt"},{"vulnerability":"VCID-qzjd-vr1m-43be"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xk8e-jc78-rkbt"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-ye2e-dsae-4fc8"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.3.2"}],"aliases":["CVE-2021-3961","GHSA-c65v-p733-9796"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-cb8w-cdv2-b3a7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/42401?format=json","vulnerability_id":"VCID-dx3k-jtmy-audv","summary":"Improper Privilege Management in Packagist snipe/snipe-it prior to 5.3.9.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0579","reference_id":"","reference_type":"","scores":[{"value":"0.00303","scoring_system":"epss","scoring_elements":"0.53936","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00303","scoring_system":"epss","scoring_elements":"0.53948","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00303","scoring_system":"epss","scoring_elements":"0.53941","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00303","scoring_system":"epss","scoring_elements":"0.53914","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00303","scoring_system":"epss","scoring_elements":"0.53883","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0579"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/db0c0e790892db874573d95f8ae4268b8a011ab1","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/db0c0e790892db874573d95f8ae4268b8a011ab1"},{"reference_url":"https://huntr.dev/bounties/70a99cf4-3241-4ffc-b9ed-5c54932f3849","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/70a99cf4-3241-4ffc-b9ed-5c54932f3849"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0579","reference_id":"CVE-2022-0579","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0579"},{"reference_url":"https://github.com/advisories/GHSA-v6vg-pxvv-g5cq","reference_id":"GHSA-v6vg-pxvv-g5cq","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-v6vg-pxvv-g5cq"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60662?format=json","purl":"pkg:composer/snipe/snipe-it@5.3.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-21zs-gaq3-77a4"},{"vulnerability":"VCID-3xtm-ufqd-zfe4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-em3j-ax33-hbdh"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-jz6q-q8r7-tfhb"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-nfxe-yksb-5fdt"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-ye2e-dsae-4fc8"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.3.9"}],"aliases":["CVE-2022-0579","GHSA-v6vg-pxvv-g5cq"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dx3k-jtmy-audv"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/42466?format=json","vulnerability_id":"VCID-em3j-ax33-hbdh","summary":"Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0622","reference_id":"","reference_type":"","scores":[{"value":"0.00071","scoring_system":"epss","scoring_elements":"0.21835","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00071","scoring_system":"epss","scoring_elements":"0.21806","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00071","scoring_system":"epss","scoring_elements":"0.21798","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00071","scoring_system":"epss","scoring_elements":"0.21857","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00071","scoring_system":"epss","scoring_elements":"0.21903","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00071","scoring_system":"epss","scoring_elements":"0.21915","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0622"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/178e44095141ab805c282f563fb088df1a10b2e2","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/178e44095141ab805c282f563fb088df1a10b2e2"},{"reference_url":"https://huntr.dev/bounties/4ed99dab-5319-4b6b-919a-84a9acd0061a","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/4ed99dab-5319-4b6b-919a-84a9acd0061a"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0622","reference_id":"CVE-2022-0622","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0622"},{"reference_url":"https://github.com/advisories/GHSA-pwwm-pwx2-2hw7","reference_id":"GHSA-pwwm-pwx2-2hw7","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-pwwm-pwx2-2hw7"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/146852?format=json","purl":"pkg:composer/snipe/snipe-it@5.3.11","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.3.11"},{"url":"http://public2.vulnerablecode.io/api/packages/512087?format=json","purl":"pkg:composer/snipe/snipe-it@6.0.0-RC-1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-21zs-gaq3-77a4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@6.0.0-RC-1"}],"aliases":["CVE-2022-0622","GHSA-pwwm-pwx2-2hw7"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-em3j-ax33-hbdh"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/43221?format=json","vulnerability_id":"VCID-en96-ata4-x3fu","summary":"Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')\nIn Snipe-IT, versions v3.0-alpha to v5.3.7 is vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-23064","reference_id":"","reference_type":"","scores":[{"value":"0.00444","scoring_system":"epss","scoring_elements":"0.63702","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00444","scoring_system":"epss","scoring_elements":"0.63723","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00444","scoring_system":"epss","scoring_elements":"0.63715","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00444","scoring_system":"epss","scoring_elements":"0.63722","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00444","scoring_system":"epss","scoring_elements":"0.63674","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-23064"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/0c4768fd2a11ac26a61814cef23a71061bfd8bcc","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/0c4768fd2a11ac26a61814cef23a71061bfd8bcc"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23064","reference_id":"CVE-2022-23064","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23064"},{"reference_url":"https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23064","reference_id":"CVE-2022-23064","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23064"},{"reference_url":"https://github.com/advisories/GHSA-9vh6-qfv6-vcqp","reference_id":"GHSA-9vh6-qfv6-vcqp","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-9vh6-qfv6-vcqp"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60174?format=json","purl":"pkg:composer/snipe/snipe-it@5.3.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-21zs-gaq3-77a4"},{"vulnerability":"VCID-3xtm-ufqd-zfe4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-dx3k-jtmy-audv"},{"vulnerability":"VCID-em3j-ax33-hbdh"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-jz6q-q8r7-tfhb"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-nfxe-yksb-5fdt"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-ye2e-dsae-4fc8"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.3.8"},{"url":"http://public2.vulnerablecode.io/api/packages/60684?format=json","purl":"pkg:composer/snipe/snipe-it@5.4.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-3xtm-ufqd-zfe4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-jz6q-q8r7-tfhb"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.4.0"}],"aliases":["CVE-2022-23064","GHSA-9vh6-qfv6-vcqp"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-en96-ata4-x3fu"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/55367?format=json","vulnerability_id":"VCID-f84w-4gun-ubej","summary":"Snipe-IT allows users to promote or demote themselves or other users\nUsers with \"User:edit\" and \"Self:api\" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.","references":[{"reference_url":"https://advisory.checkmarx.net/?search=CVE-2024-5685","reference_id":"","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L"},{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-12T19:05:09Z/"}],"url":"https://advisory.checkmarx.net/?search=CVE-2024-5685"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-5685","reference_id":"","reference_type":"","scores":[{"value":"0.00159","scoring_system":"epss","scoring_elements":"0.36637","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00159","scoring_system":"epss","scoring_elements":"0.36628","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00159","scoring_system":"epss","scoring_elements":"0.366","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00159","scoring_system":"epss","scoring_elements":"0.36563","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00159","scoring_system":"epss","scoring_elements":"0.36573","published_at":"2026-06-09T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-5685"},{"reference_url":"https://devhub.checkmarx.com/cve-details/CVE-2024-5685","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://devhub.checkmarx.com/cve-details/CVE-2024-5685"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1","reference_id":"","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L"},{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-12T19:05:09Z/"}],"url":"https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1"},{"reference_url":"https://github.com/snipe/snipe-it/pull/14745","reference_id":"","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L"},{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-12T19:05:09Z/"}],"url":"https://github.com/snipe/snipe-it/pull/14745"},{"reference_url":"https://github.com/snipe/snipe-it/releases/tag/v6.4.2","reference_id":"","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L"},{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-12T19:05:09Z/"}],"url":"https://github.com/snipe/snipe-it/releases/tag/v6.4.2"},{"reference_url":"https://devhub.checkmarx.com/cve-details/CVE-2024-5685/","reference_id":"CVE-2024-5685","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-12T19:05:09Z/"}],"url":"https://devhub.checkmarx.com/cve-details/CVE-2024-5685/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5685","reference_id":"CVE-2024-5685","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5685"},{"reference_url":"https://github.com/advisories/GHSA-544r-fc65-v832","reference_id":"GHSA-544r-fc65-v832","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-544r-fc65-v832"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/81860?format=json","purl":"pkg:composer/snipe/snipe-it@6.4.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@6.4.2"}],"aliases":["CVE-2024-5685","GHSA-544r-fc65-v832"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-f84w-4gun-ubej"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/110032?format=json","vulnerability_id":"VCID-hmvz-j385-uyfy","summary":"snipe-it vulnerable to cross-site scripting (XSS)\nCross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.0.11.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-3035","reference_id":"","reference_type":"","scores":[{"value":"0.00256","scoring_system":"epss","scoring_elements":"0.49218","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00256","scoring_system":"epss","scoring_elements":"0.49256","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00256","scoring_system":"epss","scoring_elements":"0.49243","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00256","scoring_system":"epss","scoring_elements":"0.49272","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00256","scoring_system":"epss","scoring_elements":"0.4929","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00256","scoring_system":"epss","scoring_elements":"0.49279","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-3035"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/9cf5f30c77df6ab60baab1c0e6bb0b4e773f0eae","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/9cf5f30c77df6ab60baab1c0e6bb0b4e773f0eae"},{"reference_url":"https://huntr.dev/bounties/0bbb1046-ea9e-4cb9-bc91-b294a72d1902","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/0bbb1046-ea9e-4cb9-bc91-b294a72d1902"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3035","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3035"},{"reference_url":"https://github.com/advisories/GHSA-rff2-vqm3-jpv5","reference_id":"GHSA-rff2-vqm3-jpv5","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rff2-vqm3-jpv5"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/148264?format=json","purl":"pkg:composer/snipe/snipe-it@6.0.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@6.0.11"}],"aliases":["CVE-2022-3035","GHSA-rff2-vqm3-jpv5"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hmvz-j385-uyfy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/92323?format=json","vulnerability_id":"VCID-hy2w-kubr-x7as","summary":"Snipe-IT has insecure permissions in file uploads\nInsecure Permissions vulnerability in grokability snipe-it versions through 8.4.0, fixed after 2026-03-10 commit 676a9958, allow a remote attacker to execute arbitrary code via the `app/Http/Controllers/Api/UploadedFilesController.php` component\n\n### Impact\nUsers who can view assets, consumables, etc were able to send a POST request to `/api/v1/{object_type}/{id}/files`. The API authorized with \"view\" instead of write permission and persists the file and audit log entry.\n\n### Patches\nFixed after 2026-03-10 commit 676a9958, fix released to 8.4.1.\n\n### Workarounds\nNone.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-37709","reference_id":"","reference_type":"","scores":[{"value":"0.00281","scoring_system":"epss","scoring_elements":"0.51812","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00281","scoring_system":"epss","scoring_elements":"0.51801","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00281","scoring_system":"epss","scoring_elements":"0.51822","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00306","scoring_system":"epss","scoring_elements":"0.54176","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00306","scoring_system":"epss","scoring_elements":"0.54198","published_at":"2026-06-09T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-37709"},{"reference_url":"https://github.com/grokability/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/grokability/snipe-it"},{"reference_url":"https://github.com/grokability/snipe-it/commit/676a9958895a77de340565e7a0b17ae744664904","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-05-07T17:39:06Z/"}],"url":"https://github.com/grokability/snipe-it/commit/676a9958895a77de340565e7a0b17ae744664904"},{"reference_url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-xg82-2hrv-hf64","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-05-07T17:39:06Z/"}],"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-xg82-2hrv-hf64"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-37709","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-37709"},{"reference_url":"https://github.com/advisories/GHSA-xg82-2hrv-hf64","reference_id":"GHSA-xg82-2hrv-hf64","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xg82-2hrv-hf64"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/114739?format=json","purl":"pkg:composer/snipe/snipe-it@8.4.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@8.4.1"}],"aliases":["CVE-2026-37709","GHSA-xg82-2hrv-hf64"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hy2w-kubr-x7as"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/109479?format=json","vulnerability_id":"VCID-j599-m726-cuer","summary":"Snipe-IT allows attackers to check whether a user account exists\nSnipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-44381","reference_id":"","reference_type":"","scores":[{"value":"0.00241","scoring_system":"epss","scoring_elements":"0.47569","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00241","scoring_system":"epss","scoring_elements":"0.47505","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00241","scoring_system":"epss","scoring_elements":"0.47572","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00241","scoring_system":"epss","scoring_elements":"0.47538","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00241","scoring_system":"epss","scoring_elements":"0.47525","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00241","scoring_system":"epss","scoring_elements":"0.47555","published_at":"2026-06-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-44381"},{"reference_url":"https://census-labs.com/news/2022/12/23/multiple-vulnerabilities-in-snipe-it","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://census-labs.com/news/2022/12/23/multiple-vulnerabilities-in-snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44381","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44381"},{"reference_url":"https://github.com/advisories/GHSA-qqv9-gqh5-7h99","reference_id":"GHSA-qqv9-gqh5-7h99","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qqv9-gqh5-7h99"},{"reference_url":"https://census-labs.com/news/2022/12/23/multiple-vulnerabilities-in-snipe-it/","reference_id":"multiple-vulnerabilities-in-snipe-it","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:20:46Z/"}],"url":"https://census-labs.com/news/2022/12/23/multiple-vulnerabilities-in-snipe-it/"}],"fixed_packages":[],"aliases":["CVE-2022-44381","GHSA-qqv9-gqh5-7h99"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-j599-m726-cuer"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/41605?format=json","vulnerability_id":"VCID-jvfr-43hu-pqdz","summary":"snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-3863","reference_id":"","reference_type":"","scores":[{"value":"0.00238","scoring_system":"epss","scoring_elements":"0.4704","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00238","scoring_system":"epss","scoring_elements":"0.47072","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00238","scoring_system":"epss","scoring_elements":"0.4706","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00238","scoring_system":"epss","scoring_elements":"0.4709","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00238","scoring_system":"epss","scoring_elements":"0.47108","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00238","scoring_system":"epss","scoring_elements":"0.47105","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-3863"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/fc5efd857f61f7e45c61db567bb66612bcb53128","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/fc5efd857f61f7e45c61db567bb66612bcb53128"},{"reference_url":"https://github.com/snipe/snipe-it/releases/tag/v5.3.0","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/releases/tag/v5.3.0"},{"reference_url":"https://huntr.dev/bounties/1dbc8d79-1b53-44a3-a576-faec78f29ba0","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/1dbc8d79-1b53-44a3-a576-faec78f29ba0"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3863","reference_id":"CVE-2021-3863","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3863"},{"reference_url":"https://github.com/advisories/GHSA-5rg2-6qr5-2xp8","reference_id":"GHSA-5rg2-6qr5-2xp8","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-5rg2-6qr5-2xp8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/140527?format=json","purl":"pkg:composer/snipe/snipe-it@5.3.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-1dda-mx1c-efa7"},{"vulnerability":"VCID-21zs-gaq3-77a4"},{"vulnerability":"VCID-2akh-m243-mufc"},{"vulnerability":"VCID-3xtm-ufqd-zfe4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-5yd4-b352-mkbn"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6ujw-nug2-zbfr"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-cb8w-cdv2-b3a7"},{"vulnerability":"VCID-dx3k-jtmy-audv"},{"vulnerability":"VCID-em3j-ax33-hbdh"},{"vulnerability":"VCID-en96-ata4-x3fu"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-jz6q-q8r7-tfhb"},{"vulnerability":"VCID-k283-n11p-nba1"},{"vulnerability":"VCID-kp2t-jpsa-abds"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-nfxe-yksb-5fdt"},{"vulnerability":"VCID-qzjd-vr1m-43be"},{"vulnerability":"VCID-r18v-762e-xqha"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xk8e-jc78-rkbt"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-ye2e-dsae-4fc8"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.3.0"}],"aliases":["CVE-2021-3863","GHSA-5rg2-6qr5-2xp8"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jvfr-43hu-pqdz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/42927?format=json","vulnerability_id":"VCID-jz6q-q8r7-tfhb","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nStored Cross Site Scripting vulnerability in `Item name` parameter in GitHub repository snipe/snipe-it prior to v5.4.3. Exploiting the vulnerability may allow malicious users to steal victim's Cookie data.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-1380","reference_id":"","reference_type":"","scores":[{"value":"0.00249","scoring_system":"epss","scoring_elements":"0.48341","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00249","scoring_system":"epss","scoring_elements":"0.48372","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00249","scoring_system":"epss","scoring_elements":"0.4836","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00249","scoring_system":"epss","scoring_elements":"0.48389","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00249","scoring_system":"epss","scoring_elements":"0.48407","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00249","scoring_system":"epss","scoring_elements":"0.48404","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-1380"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/f211c11034baf4281aa62e7b5e0347248d995ee9","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/f211c11034baf4281aa62e7b5e0347248d995ee9"},{"reference_url":"https://huntr.dev/bounties/3d45cfca-3a72-4578-b735-98837b998a12","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/3d45cfca-3a72-4578-b735-98837b998a12"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1380","reference_id":"CVE-2022-1380","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1380"},{"reference_url":"https://github.com/advisories/GHSA-p885-prv3-m4xv","reference_id":"GHSA-p885-prv3-m4xv","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-p885-prv3-m4xv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61406?format=json","purl":"pkg:composer/snipe/snipe-it@5.4.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.4.3"}],"aliases":["CVE-2022-1380","GHSA-p885-prv3-m4xv"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jz6q-q8r7-tfhb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/41708?format=json","vulnerability_id":"VCID-k283-n11p-nba1","summary":"snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-3931","reference_id":"","reference_type":"","scores":[{"value":"0.00128","scoring_system":"epss","scoring_elements":"0.31717","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00128","scoring_system":"epss","scoring_elements":"0.31704","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00128","scoring_system":"epss","scoring_elements":"0.31681","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00128","scoring_system":"epss","scoring_elements":"0.31714","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00128","scoring_system":"epss","scoring_elements":"0.31752","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00128","scoring_system":"epss","scoring_elements":"0.31786","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-3931"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/0d811d067c8e064252c0143c39d6cd4c3133679e","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/0d811d067c8e064252c0143c39d6cd4c3133679e"},{"reference_url":"https://huntr.dev/bounties/03b21d69-3bf5-4b2f-a2cf-872dd677a68f","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/03b21d69-3bf5-4b2f-a2cf-872dd677a68f"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3931","reference_id":"CVE-2021-3931","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3931"},{"reference_url":"https://github.com/advisories/GHSA-533p-cp2g-99wp","reference_id":"GHSA-533p-cp2g-99wp","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-533p-cp2g-99wp"}],"fixed_packages":[],"aliases":["CVE-2021-3931","GHSA-533p-cp2g-99wp"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-k283-n11p-nba1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/42069?format=json","vulnerability_id":"VCID-kp2t-jpsa-abds","summary":"snipe-it is vulnerable to Improper Access Control","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0178","reference_id":"","reference_type":"","scores":[{"value":"0.00213","scoring_system":"epss","scoring_elements":"0.43776","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00213","scoring_system":"epss","scoring_elements":"0.43804","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00213","scoring_system":"epss","scoring_elements":"0.43794","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00213","scoring_system":"epss","scoring_elements":"0.43829","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00213","scoring_system":"epss","scoring_elements":"0.43854","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00213","scoring_system":"epss","scoring_elements":"0.43846","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0178"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/0e5ef53c352754de2778ffa20c85da15fd6f7ae0","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/0e5ef53c352754de2778ffa20c85da15fd6f7ae0"},{"reference_url":"https://github.com/snipe/snipe-it/commit/512dbfee7acfcafa1524c8b2fb4cc4ef96958d0b","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/512dbfee7acfcafa1524c8b2fb4cc4ef96958d0b"},{"reference_url":"https://huntr.dev/bounties/81c6b974-d0b3-410b-a902-8324a55b1368","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/81c6b974-d0b3-410b-a902-8324a55b1368"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0178","reference_id":"CVE-2022-0178","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0178"},{"reference_url":"https://github.com/advisories/GHSA-xc47-3rch-cv57","reference_id":"GHSA-xc47-3rch-cv57","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xc47-3rch-cv57"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60174?format=json","purl":"pkg:composer/snipe/snipe-it@5.3.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-21zs-gaq3-77a4"},{"vulnerability":"VCID-3xtm-ufqd-zfe4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-dx3k-jtmy-audv"},{"vulnerability":"VCID-em3j-ax33-hbdh"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-jz6q-q8r7-tfhb"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-nfxe-yksb-5fdt"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-ye2e-dsae-4fc8"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.3.8"}],"aliases":["CVE-2022-0178","GHSA-xc47-3rch-cv57"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kp2t-jpsa-abds"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/43035?format=json","vulnerability_id":"VCID-kxug-6d3m-ryhb","summary":"Incorrect Authorization\nImproper Access Control in GitHub repository snipe/snipe-it prior to 5.4.4.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-1511","reference_id":"","reference_type":"","scores":[{"value":"0.00255","scoring_system":"epss","scoring_elements":"0.49057","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00255","scoring_system":"epss","scoring_elements":"0.49095","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00255","scoring_system":"epss","scoring_elements":"0.49083","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00255","scoring_system":"epss","scoring_elements":"0.49112","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00255","scoring_system":"epss","scoring_elements":"0.49128","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00255","scoring_system":"epss","scoring_elements":"0.49118","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-1511"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/2e9cf8fa87a025c0eac9f79f4864b3fdd33a950c","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/2e9cf8fa87a025c0eac9f79f4864b3fdd33a950c"},{"reference_url":"https://github.com/snipe/snipe-it/pull/10991","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/pull/10991"},{"reference_url":"https://huntr.dev/bounties/4a1723e9-5bc4-4c4b-bceb-1c45964cc71d","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/4a1723e9-5bc4-4c4b-bceb-1c45964cc71d"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1511","reference_id":"CVE-2022-1511","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1511"},{"reference_url":"https://github.com/advisories/GHSA-p2vw-f87c-q597","reference_id":"GHSA-p2vw-f87c-q597","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-p2vw-f87c-q597"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61599?format=json","purl":"pkg:composer/snipe/snipe-it@5.4.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.4.4"},{"url":"http://public2.vulnerablecode.io/api/packages/512087?format=json","purl":"pkg:composer/snipe/snipe-it@6.0.0-RC-1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-21zs-gaq3-77a4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@6.0.0-RC-1"}],"aliases":["CVE-2022-1511","GHSA-p2vw-f87c-q597"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kxug-6d3m-ryhb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/109388?format=json","vulnerability_id":"VCID-nf17-pyfu-4qds","summary":"Snipe-IT vulnerable to Cross Site Scripting for View Assigned Assets\nSnipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-44380","reference_id":"","reference_type":"","scores":[{"value":"0.00233","scoring_system":"epss","scoring_elements":"0.46284","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00233","scoring_system":"epss","scoring_elements":"0.4625","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00233","scoring_system":"epss","scoring_elements":"0.46239","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00233","scoring_system":"epss","scoring_elements":"0.46265","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00233","scoring_system":"epss","scoring_elements":"0.46216","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00233","scoring_system":"epss","scoring_elements":"0.46286","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-44380"},{"reference_url":"https://census-labs.com/news/2022/12/23/multiple-vulnerabilities-in-snipe-it","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://census-labs.com/news/2022/12/23/multiple-vulnerabilities-in-snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44380","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44380"},{"reference_url":"https://github.com/advisories/GHSA-363q-j92x-7543","reference_id":"GHSA-363q-j92x-7543","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-363q-j92x-7543"},{"reference_url":"https://census-labs.com/news/2022/12/23/multiple-vulnerabilities-in-snipe-it/","reference_id":"multiple-vulnerabilities-in-snipe-it","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:22:03Z/"}],"url":"https://census-labs.com/news/2022/12/23/multiple-vulnerabilities-in-snipe-it/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/146488?format=json","purl":"pkg:composer/snipe/snipe-it@6.0.14","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@6.0.14"}],"aliases":["CVE-2022-44380","GHSA-363q-j92x-7543"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-nf17-pyfu-4qds"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/42421?format=json","vulnerability_id":"VCID-nfxe-yksb-5fdt","summary":"Improper Privilege Management in Packagist snipe/snipe-it prior to 5.3.11.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0611","reference_id":"","reference_type":"","scores":[{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.53057","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.53012","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.53037","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.52988","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.53049","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0611"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/321be4733d3997fc738f0118e1b9af5905f95439","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/321be4733d3997fc738f0118e1b9af5905f95439"},{"reference_url":"https://huntr.dev/bounties/7b7447fc-f1b0-446c-b016-ee3f6511010b","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/7b7447fc-f1b0-446c-b016-ee3f6511010b"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0611","reference_id":"CVE-2022-0611","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0611"},{"reference_url":"https://github.com/advisories/GHSA-j57w-3c39-gpp5","reference_id":"GHSA-j57w-3c39-gpp5","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-j57w-3c39-gpp5"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/146852?format=json","purl":"pkg:composer/snipe/snipe-it@5.3.11","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.3.11"},{"url":"http://public2.vulnerablecode.io/api/packages/60684?format=json","purl":"pkg:composer/snipe/snipe-it@5.4.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-3xtm-ufqd-zfe4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-jz6q-q8r7-tfhb"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.4.0"},{"url":"http://public2.vulnerablecode.io/api/packages/512087?format=json","purl":"pkg:composer/snipe/snipe-it@6.0.0-RC-1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-21zs-gaq3-77a4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@6.0.0-RC-1"}],"aliases":["CVE-2022-0611","GHSA-j57w-3c39-gpp5"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-nfxe-yksb-5fdt"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/41845?format=json","vulnerability_id":"VCID-qzjd-vr1m-43be","summary":"Incorrect Authorization\nsnipe-it is vulnerable to Improper Access Control","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-4089","reference_id":"","reference_type":"","scores":[{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.45003","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.45039","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.45027","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.45056","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.45076","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.45071","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-4089"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/1699c09758e56f740437674a8d6ba36443399f24","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/1699c09758e56f740437674a8d6ba36443399f24"},{"reference_url":"https://huntr.dev/bounties/19453ef1-4d77-4cff-b7e8-1bc8f3af0862","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/19453ef1-4d77-4cff-b7e8-1bc8f3af0862"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4089","reference_id":"CVE-2021-4089","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4089"},{"reference_url":"https://github.com/advisories/GHSA-9vwf-54m9-gc4f","reference_id":"GHSA-9vwf-54m9-gc4f","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-9vwf-54m9-gc4f"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59769?format=json","purl":"pkg:composer/snipe/snipe-it@5.3.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-21zs-gaq3-77a4"},{"vulnerability":"VCID-3xtm-ufqd-zfe4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-5yd4-b352-mkbn"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6ujw-nug2-zbfr"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-dx3k-jtmy-audv"},{"vulnerability":"VCID-em3j-ax33-hbdh"},{"vulnerability":"VCID-en96-ata4-x3fu"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-jz6q-q8r7-tfhb"},{"vulnerability":"VCID-kp2t-jpsa-abds"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-nfxe-yksb-5fdt"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xk8e-jc78-rkbt"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-ye2e-dsae-4fc8"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.3.4"}],"aliases":["CVE-2021-4089","GHSA-9vwf-54m9-gc4f"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-qzjd-vr1m-43be"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/41705?format=json","vulnerability_id":"VCID-r18v-762e-xqha","summary":"snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-3938","reference_id":"","reference_type":"","scores":[{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45463","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45451","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45438","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45411","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45479","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45483","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-3938"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"3.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/9ed1442bd124710f4178992cc4eca5236c7396b9","reference_id":"","reference_type":"","scores":[{"value":"3.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/9ed1442bd124710f4178992cc4eca5236c7396b9"},{"reference_url":"https://huntr.dev/bounties/198a0d67-9189-4170-809b-0f8aea43b063","reference_id":"","reference_type":"","scores":[{"value":"3.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/198a0d67-9189-4170-809b-0f8aea43b063"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3938","reference_id":"CVE-2021-3938","reference_type":"","scores":[{"value":"3.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3938"},{"reference_url":"https://github.com/advisories/GHSA-2cqg-q7jm-j35c","reference_id":"GHSA-2cqg-q7jm-j35c","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-2cqg-q7jm-j35c"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60684?format=json","purl":"pkg:composer/snipe/snipe-it@5.4.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-3xtm-ufqd-zfe4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-jz6q-q8r7-tfhb"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.4.0"}],"aliases":["CVE-2021-3938","GHSA-2cqg-q7jm-j35c"],"risk_score":1.8,"exploitability":"0.5","weighted_severity":"3.5","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-r18v-762e-xqha"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/56003?format=json","vulnerability_id":"VCID-rq9n-n2fj-xkdy","summary":"Snipe-IT remote code execution\nSnipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-48987","reference_id":"","reference_type":"","scores":[{"value":"0.02734","scoring_system":"epss","scoring_elements":"0.86261","published_at":"2026-06-06T12:55:00Z"},{"value":"0.02734","scoring_system":"epss","scoring_elements":"0.86245","published_at":"2026-06-08T12:55:00Z"},{"value":"0.02734","scoring_system":"epss","scoring_elements":"0.86257","published_at":"2026-06-07T12:55:00Z"},{"value":"0.02734","scoring_system":"epss","scoring_elements":"0.86259","published_at":"2026-06-09T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-48987"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/releases/tag/v7.0.10","reference_id":"","reference_type":"","scores":[{"value":"6.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-11T14:55:26Z/"}],"url":"https://github.com/snipe/snipe-it/releases/tag/v7.0.10"},{"reference_url":"https://snipe-it.readme.io/docs/key-rotation","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://snipe-it.readme.io/docs/key-rotation"},{"reference_url":"https://www.synacktiv.com/advisories/snipe-it-unauthenticated-remote-command-execution-when-appkey-known","reference_id":"","reference_type":"","scores":[{"value":"6.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-11T14:55:26Z/"}],"url":"https://www.synacktiv.com/advisories/snipe-it-unauthenticated-remote-command-execution-when-appkey-known"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48987","reference_id":"CVE-2024-48987","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48987"},{"reference_url":"https://github.com/advisories/GHSA-57qh-vmjr-5jxg","reference_id":"GHSA-57qh-vmjr-5jxg","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-57qh-vmjr-5jxg"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/82926?format=json","purl":"pkg:composer/snipe/snipe-it@7.0.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@7.0.10"}],"aliases":["CVE-2024-48987","GHSA-57qh-vmjr-5jxg"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rq9n-n2fj-xkdy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/94653?format=json","vulnerability_id":"VCID-xk24-e9d1-4bd8","summary":"Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0)\n### Impact\nUsers with component view access could be impacted by an unescaped `notes` column. \n\n### Patches\nThis was patched in https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438, and is fixed in v8.4.1 or greater. \n\n### Workarounds\nNone.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-44831","reference_id":"","reference_type":"","scores":[{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.01987","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.0201","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02017","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02006","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.01993","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-44831"},{"reference_url":"https://github.com/grokability/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/grokability/snipe-it"},{"reference_url":"https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T16:05:13Z/"}],"url":"https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438"},{"reference_url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-r42m-953q-6vjx","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T16:05:13Z/"}],"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-r42m-953q-6vjx"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44831","reference_id":"CVE-2026-44831","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44831"},{"reference_url":"https://github.com/advisories/GHSA-r42m-953q-6vjx","reference_id":"GHSA-r42m-953q-6vjx","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-r42m-953q-6vjx"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/114739?format=json","purl":"pkg:composer/snipe/snipe-it@8.4.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@8.4.1"}],"aliases":["CVE-2026-44831","GHSA-r42m-953q-6vjx"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-xk24-e9d1-4bd8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/42047?format=json","vulnerability_id":"VCID-xk8e-jc78-rkbt","summary":"Incorrect Default Permissions\nsnipe-it is vulnerable to Improper Access Control","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0179","reference_id":"","reference_type":"","scores":[{"value":"0.00221","scoring_system":"epss","scoring_elements":"0.44733","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00221","scoring_system":"epss","scoring_elements":"0.4481","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00221","scoring_system":"epss","scoring_elements":"0.44804","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00221","scoring_system":"epss","scoring_elements":"0.4477","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00221","scoring_system":"epss","scoring_elements":"0.44758","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00221","scoring_system":"epss","scoring_elements":"0.44789","published_at":"2026-06-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0179"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/cf14a0222c67472086cd08b2155f045edaf75f2e","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/cf14a0222c67472086cd08b2155f045edaf75f2e"},{"reference_url":"https://github.com/snipe/snipe-it/pull/10498","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/pull/10498"},{"reference_url":"https://huntr.dev/bounties/efdf2ead-f9d1-4767-9f02-d11f762d15e7","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/efdf2ead-f9d1-4767-9f02-d11f762d15e7"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0179","reference_id":"CVE-2022-0179","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0179"},{"reference_url":"https://github.com/advisories/GHSA-w3v3-cxq5-9vr4","reference_id":"GHSA-w3v3-cxq5-9vr4","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-w3v3-cxq5-9vr4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60142?format=json","purl":"pkg:composer/snipe/snipe-it@5.3.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-21zs-gaq3-77a4"},{"vulnerability":"VCID-3xtm-ufqd-zfe4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-dx3k-jtmy-audv"},{"vulnerability":"VCID-em3j-ax33-hbdh"},{"vulnerability":"VCID-en96-ata4-x3fu"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-jz6q-q8r7-tfhb"},{"vulnerability":"VCID-kp2t-jpsa-abds"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-nfxe-yksb-5fdt"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-ye2e-dsae-4fc8"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.3.7"}],"aliases":["CVE-2022-0179","GHSA-w3v3-cxq5-9vr4"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-xk8e-jc78-rkbt"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57244?format=json","vulnerability_id":"VCID-xkq8-5ufk-3uaf","summary":"Grokability Snipe-IT has incorrect authorization for accessing asset information\nGrokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-47226","reference_id":"","reference_type":"","scores":[{"value":"0.01048","scoring_system":"epss","scoring_elements":"0.77873","published_at":"2026-06-08T12:55:00Z"},{"value":"0.01048","scoring_system":"epss","scoring_elements":"0.77891","published_at":"2026-06-09T12:55:00Z"},{"value":"0.01048","scoring_system":"epss","scoring_elements":"0.77884","published_at":"2026-06-07T12:55:00Z"},{"value":"0.01048","scoring_system":"epss","scoring_elements":"0.77894","published_at":"2026-06-06T12:55:00Z"},{"value":"0.01048","scoring_system":"epss","scoring_elements":"0.77888","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-47226"},{"reference_url":"https://github.com/grokability/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"5.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/grokability/snipe-it"},{"reference_url":"https://github.com/grokability/snipe-it/compare/v8.0.4...v8.1.0","reference_id":"","reference_type":"","scores":[{"value":"5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"},{"value":"5.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-05T15:36:35Z/"}],"url":"https://github.com/grokability/snipe-it/compare/v8.0.4...v8.1.0"},{"reference_url":"https://github.com/grokability/snipe-it/pull/16672","reference_id":"","reference_type":"","scores":[{"value":"5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"},{"value":"5.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-05T15:36:35Z/"}],"url":"https://github.com/grokability/snipe-it/pull/16672"},{"reference_url":"https://github.com/grokability/snipe-it/releases/tag/v8.1.0","reference_id":"","reference_type":"","scores":[{"value":"5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"},{"value":"5.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-05T15:36:35Z/"}],"url":"https://github.com/grokability/snipe-it/releases/tag/v8.1.0"},{"reference_url":"https://github.com/koyomihack00/CVE-2025-47226/blob/main/PoC/idor-exploit.md","reference_id":"","reference_type":"","scores":[{"value":"5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"},{"value":"5.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-05T15:36:35Z/"}],"url":"https://github.com/koyomihack00/CVE-2025-47226/blob/main/PoC/idor-exploit.md"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/52282.txt","reference_id":"CVE-2025-47226","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/52282.txt"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47226","reference_id":"CVE-2025-47226","reference_type":"","scores":[{"value":"5.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47226"},{"reference_url":"https://github.com/advisories/GHSA-h3vp-qwmx-5j25","reference_id":"GHSA-h3vp-qwmx-5j25","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-h3vp-qwmx-5j25"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/85036?format=json","purl":"pkg:composer/snipe/snipe-it@8.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-xk24-e9d1-4bd8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@8.1.0"}],"aliases":["CVE-2025-47226","GHSA-h3vp-qwmx-5j25"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-xkq8-5ufk-3uaf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/42416?format=json","vulnerability_id":"VCID-ye2e-dsae-4fc8","summary":"Exposure of Sensitive Information in snipe/snipe-it\nObservable Discrepancy in Packagist snipe/snipe-it prior to v5.3.10.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0569","reference_id":"","reference_type":"","scores":[{"value":"0.00356","scoring_system":"epss","scoring_elements":"0.58223","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00356","scoring_system":"epss","scoring_elements":"0.58197","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00356","scoring_system":"epss","scoring_elements":"0.58212","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00356","scoring_system":"epss","scoring_elements":"0.58165","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00356","scoring_system":"epss","scoring_elements":"0.58214","published_at":"2026-06-09T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0569"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/05c0819776b07425b2831cd31a8a0f4e7ac30c09","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/05c0819776b07425b2831cd31a8a0f4e7ac30c09"},{"reference_url":"https://huntr.dev/bounties/b41d5e63-bcd8-4864-8a2e-8ec74eec520b","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/b41d5e63-bcd8-4864-8a2e-8ec74eec520b"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0569","reference_id":"CVE-2022-0569","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0569"},{"reference_url":"https://github.com/advisories/GHSA-qpv2-jxc7-3638","reference_id":"GHSA-qpv2-jxc7-3638","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qpv2-jxc7-3638"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60677?format=json","purl":"pkg:composer/snipe/snipe-it@5.3.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-3xtm-ufqd-zfe4"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-91vw-khmf-6bbm"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-em3j-ax33-hbdh"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-jz6q-q8r7-tfhb"},{"vulnerability":"VCID-kxug-6d3m-ryhb"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-nfxe-yksb-5fdt"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"},{"vulnerability":"VCID-zyzw-hjhm-qbew"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@5.3.10"}],"aliases":["CVE-2022-0569","GHSA-qpv2-jxc7-3638"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ye2e-dsae-4fc8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/110003?format=json","vulnerability_id":"VCID-zyzw-hjhm-qbew","summary":"Insufficient Session Expiration in snipe/snipe-it\nSession Fixation in GitHub repository snipe/snipe-it prior to version 6.0.10. The session is not invalidated after a password change.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-2997","reference_id":"","reference_type":"","scores":[{"value":"0.00353","scoring_system":"epss","scoring_elements":"0.57922","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00353","scoring_system":"epss","scoring_elements":"0.57973","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00353","scoring_system":"epss","scoring_elements":"0.57958","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00353","scoring_system":"epss","scoring_elements":"0.57972","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00353","scoring_system":"epss","scoring_elements":"0.57983","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00353","scoring_system":"epss","scoring_elements":"0.57975","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-2997"},{"reference_url":"https://github.com/snipe/snipe-it","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it"},{"reference_url":"https://github.com/snipe/snipe-it/commit/6fde72a69335c80079363b7d26aa94e7f67400e1","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/snipe/snipe-it/commit/6fde72a69335c80079363b7d26aa94e7f67400e1"},{"reference_url":"https://huntr.dev/bounties/c09bf21b-50d2-49f0-8c92-49f6b3c358d8","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://huntr.dev/bounties/c09bf21b-50d2-49f0-8c92-49f6b3c358d8"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2997","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2997"},{"reference_url":"https://github.com/advisories/GHSA-cmxc-9ghj-jp87","reference_id":"GHSA-cmxc-9ghj-jp87","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-cmxc-9ghj-jp87"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/146075?format=json","purl":"pkg:composer/snipe/snipe-it@6.0.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16y9-smp1-nfaa"},{"vulnerability":"VCID-1d8d-19xp-9qdz"},{"vulnerability":"VCID-5cbq-47qe-gya8"},{"vulnerability":"VCID-6qb4-an9b-aufh"},{"vulnerability":"VCID-6wam-dqsj-e3dv"},{"vulnerability":"VCID-6xuf-y113-3qh1"},{"vulnerability":"VCID-9uf7-64th-4kb9"},{"vulnerability":"VCID-acwy-5nbp-yyb4"},{"vulnerability":"VCID-bkce-dwzp-yqda"},{"vulnerability":"VCID-bpnp-1u65-zuc5"},{"vulnerability":"VCID-c5ff-jcx2-8qef"},{"vulnerability":"VCID-f84w-4gun-ubej"},{"vulnerability":"VCID-hmvz-j385-uyfy"},{"vulnerability":"VCID-hy2w-kubr-x7as"},{"vulnerability":"VCID-j599-m726-cuer"},{"vulnerability":"VCID-nf17-pyfu-4qds"},{"vulnerability":"VCID-rq9n-n2fj-xkdy"},{"vulnerability":"VCID-xk24-e9d1-4bd8"},{"vulnerability":"VCID-xkq8-5ufk-3uaf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@6.0.10"}],"aliases":["CVE-2022-2997","GHSA-cmxc-9ghj-jp87"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zyzw-hjhm-qbew"}],"fixing_vulnerabilities":[],"risk_score":"10.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/snipe/snipe-it@4.7.5"}