CVE-2025-63743

EUVD-2025-209423 MEDIUM

2026-04-13 mitre

XSS N A

5.4

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 15:26 vuln.today

CVSS Changed

Apr 14, 2026 - 15:22 NVD

5.4 (MEDIUM)

DescriptionNVD

Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated attacker with lowest privileges sufficient only to log in, to inject arbitrary JavaScript code via "Name" and "Surname" fields. The JavaScript code is executed whenever "Activity Report" or modified profile is viewed directly by any user with sufficient permissions. Successful exploitation of this issue requires that the profile's "Display Name" is not set. The vulnerability is fixed in v8.3.2.

AnalysisAI

Stored cross-site scripting in Snipe-IT asset management system v8.3.0-8.3.1 allows authenticated users with basic login privileges to inject malicious JavaScript via Name and Surname fields, which executes when other users view Activity Reports or modified profiles. This vulnerability requires the victim's Display Name to be unset and affects all users with sufficient permissions to access those views. Patch available in v8.3.2; EPSS score is minimal (0.01%), indicating low empirical exploitation likelihood despite network-accessible attack vector.

Technical ContextAI

Snipe-IT is a Laravel-based web application for IT asset management. The vulnerability stems from insufficient input validation and output encoding in user profile fields (Name, Surname). CWE-79 (Improper Neutralization of Input During Web Page Generation-'Cross-site Scripting') indicates that user-supplied input is stored in the application database and later rendered in HTML contexts (Activity Report view, profile modification pages) without proper sanitization or Content Security Policy. The stored XSS payload executes in the browser of any user viewing these pages, making it persistent and affecting multiple users rather than just the attacker. The condition that Display Name must be unset suggests a fallback rendering logic where Name/Surname fields are used directly when the preferred Display Name field is empty.

RemediationAI

Upgrade Snipe-IT immediately to version 8.3.2 or later, which contains the fix confirmed in the upstream commit (b6d397bcca4e8a05176b782de769d7160058bfc4). For users unable to upgrade immediately, ensure that Display Name fields are populated for all active user profiles to prevent the fallback to Name/Surname fields; however, this is a temporary control only and does not eliminate the vulnerability. Web application firewalls or input validation proxies may be configured to reject HTML/JavaScript patterns in profile API endpoints, though such mitigations should be considered temporary pending patching. Reference vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2025-63743 for additional context.

CVE-2025-63743 vulnerability details – vuln.today

Back