Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-3amw-v6wf-8yg7
Vulnerability ID VCID-3amw-v6wf-8yg7
Aliases CVE-2025-64027
GHSA-8x9v-8qgj-945x
Summary Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/update request to inject arbitrary HTML or JavaScript into the progress_message. Because the server accepts the modified input without sanitization and reflects it back to the user, arbitrary JavaScript executes in the browser of any authenticated admin who views the import page. NOTE: this is disputed by the Supplier because the report only demonstrates that an authenticated user can choose to conduct a man-in-the-middle attack against himself.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-64027
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-8x9v-8qgj-945x
cvssv4 5.2 https://github.com/cybercrewinc/CVE-2025-64027
generic_textual MODERATE https://github.com/cybercrewinc/CVE-2025-64027
cvssv3.1 6.1 https://github.com/cybercrewinc/CVE-2025-64027/
ssvc Track https://github.com/cybercrewinc/CVE-2025-64027/
cvssv3.1 6.1 https://github.com/grokability/snipe-it
cvssv4 5.2 https://github.com/grokability/snipe-it
generic_textual MODERATE https://github.com/grokability/snipe-it
ssvc Track https://github.com/grokability/snipe-it
cvssv4 5.2 https://nvd.nist.gov/vuln/detail/CVE-2025-64027
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-64027
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-64027
CVE-2025-64027 https://github.com/cybercrewinc/CVE-2025-64027
CVE-2025-64027 https://github.com/cybercrewinc/CVE-2025-64027/
CVE-2025-64027 https://nvd.nist.gov/vuln/detail/CVE-2025-64027
GHSA-8x9v-8qgj-945x https://github.com/advisories/GHSA-8x9v-8qgj-945x
snipe-it https://github.com/grokability/snipe-it
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P Found at https://github.com/cybercrewinc/CVE-2025-64027
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/cybercrewinc/CVE-2025-64027/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-20T21:37:16Z/ Found at https://github.com/cybercrewinc/CVE-2025-64027/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/grokability/snipe-it
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P Found at https://github.com/grokability/snipe-it
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-20T21:37:16Z/ Found at https://github.com/grokability/snipe-it
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P Found at https://nvd.nist.gov/vuln/detail/CVE-2025-64027
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.02111
EPSS Score 0.00013
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:57:16.877735+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/64xxx/CVE-2025-64027.json 38.6.0