EUVD-2026-62626
GHSA-c8qc-wf67-342w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because attacker needs authenticated write access to manufacturer/supplier records; UI:R for victim page-view dependency; S:C with C:L/I:L reflecting session-context XSS impact on the victim.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a selector, concatenates countId.substring(1) into an HTML string, and passes the string to jQuery .after(). A crafted name can therefore execute JavaScript when an authenticated user views the manufacturer detail page or supplier detail page, potentially exposing data or actions available to that session. This issue is fixed in version 8.6.2.
AnalysisAI
Stored cross-site scripting in Snipe-IT prior to 8.6.2 allows an authenticated low-privilege user to inject arbitrary JavaScript via a crafted manufacturer or supplier name, which executes in the browser of any authenticated user who views the affected detail page. The CVSS 4.0 vector assigns SC:H/SI:H on the subsequent system, reflecting that a successful payload delivered to an administrator can yield full session compromise - including data exfiltration and action execution - against the Snipe-IT instance. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the vulnerability mechanism is fully disclosed via the public GitHub security advisory and fix commit.
Technical ContextAI
Snipe-IT is a PHP/Laravel IT asset management system (CPE: cpe:2.3:a:grokability:snipe-it:*:*:*:*:*:*:*:*). The vulnerability resides in resources/views/partials/bootstrap-table.blade.php, where the Blade table component exposes the passed $name variable as a data-selected-count-id HTML attribute. Client-side JavaScript reads this attribute via jQuery's .data() - which HTML-decodes entity-encoded values before returning them - then uses the decoded string both as a jQuery selector and concatenates countId.substring(1) directly into an HTML string supplied to jQuery's .after() method. Because jQuery parses HTML strings passed to DOM manipulation methods, any embedded script tags or event-handler attributes in the attacker-controlled name are executed by the browser. CWE-79 (Improper Neutralization of Input During Web Page Generation) directly describes this failure to treat stored user input as text rather than markup at the point of DOM insertion. The fix replaces all jQuery selector usage and HTML string concatenation with document.getElementById() and jQuery element constructors ($('<span/>', {...})) combined with document.createTextNode(), ensuring the attacker-controlled value is always treated as plain text.
RemediationAI
Upgrade Snipe-IT to version 8.6.2 or later; this is the vendor-confirmed fix available at https://github.com/grokability/snipe-it/releases/tag/v8.6.2. The fix eliminates the vulnerability by replacing jQuery HTML string concatenation with safe DOM API calls throughout the affected bootstrap-table partial. If an immediate upgrade is not feasible, restrict write access to manufacturer and supplier record creation and editing to the minimum set of highly trusted users, since the attack requires an authenticated account with those permissions - note that this workaround reduces attack surface but does not eliminate risk if any write-enabled account is compromised or malicious. Review existing manufacturer and supplier names for unexpected HTML or script content as an indicator of prior exploitation. No Content Security Policy workaround fully mitigates stored XSS without potential application breakage, so upgrading is strongly preferred.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today