Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/snipe/snipe-it@8.7.0
purl pkg:composer/snipe/snipe-it@8.7.0
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score
Vulnerabilities affecting this package (1)
Advisory Summary Fixed in package version
CVE-2021-4075

snipe-it is vulnerable to Server-Side Request Forgery (SSRF) There are no reported fixed by versions.
Vulnerabilities fixed by this package (3)

Advisory Summary Aliases
GHSA-396x-xmvh-p563
Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API Snipe-IT's uploaded-files API accepts XML documents and later … CVE-2026-63498
GHSA-hxcx-9h4f-42xx
Snipe-IT: 2FA bypass via the API token flow ### Impact An attacker who knows a victim's password fully bypasses that … CVE-2026-63493
GHSA-p9h3-gvpq-5539
Snipe-IT: Stored XSS via Custom Field name in asset-list column headers ### Impact A user with the "customfields.create" permission can … CVE-2026-62368