Search for packages
| purl | pkg:composer/snipe/snipe-it@8.6.3 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 3.9 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2021-4075
|
snipe-it is vulnerable to Server-Side Request Forgery (SSRF) | There are no reported fixed by versions. |
|
GHSA-396x-xmvh-p563
Aliases: CVE-2026-63498 |
Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API Snipe-IT's uploaded-files API accepts XML documents and later … |
Vulnerable |
|
GHSA-hxcx-9h4f-42xx
Aliases: CVE-2026-63493 |
Snipe-IT: 2FA bypass via the API token flow ### Impact An attacker who knows a victim's password fully bypasses that … |
Vulnerable |
|
GHSA-p9h3-gvpq-5539
Aliases: CVE-2026-62368 |
Snipe-IT: Stored XSS via Custom Field name in asset-list column headers ### Impact A user with the "customfields.create" permission can … |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-r9r3-g9fp-3q4q
|
Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET ### Impact Any activated account in a company can read every … |
CVE-2026-55703
|
|
GHSA-3hgv-jr5j-cg9x
|
Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover ### Impact An attacker can completely bypass file-name … |
CVE-2026-55694
|
|
GHSA-c6w2-j4wq-mvwg
|
Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode ### Impact Due to inconsistent authorization checks, a company-scoped user can bypass … |
CVE-2026-55643
|