Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: grokability snipe-it 8.7.0 Clear all filters
TI-2026-59295 CVE-2026-86738 · GHSA-hxfh-ccwg-qrc6

Snipe-IT before 8.7.0 CSS Injection via Custom CSS

Priority MEDIUM 43

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters.

CVSS 4.0CRITICAL 9.3 Network High privileges No interaction EPSS 0.00487 Published 2026-09-08 Fixed in 8.7.0 CWE-79
TI-2026-59293 CVE-2026-86736 · GHSA-4vvp-2h3v-73fw

snipe-it before 8.7.0 Checkout Request Counter Integrity Failure

Priority LOW 24

snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requests_counter through duplicate submissions and cancellations wi…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00298 Published 2026-09-08 Fixed in 8.7.0 CWE-682
TI-2026-59292 CVE-2026-86735 · GHSA-m3v2-6c3r-vqh9

snipe-it before 8.7.0 SSRF via IPv6 transition address bypass

Priority LOW 26

snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets.

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.00313 Published 2026-09-08 Fixed in 8.7.0 CWE-918
TI-2026-59290 CVE-2026-86733 · GHSA-f9ch-gg2x-p955

Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore

Priority MEDIUM 40

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) without the --binary-mode flag, so the client interprets lines beginning with back…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00579 Published 2026-09-08 Fixed in 8.7.0 CWE-78