snipeitapp records

121 published records for vendor snipeitapp.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 93.1%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

121 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2026-37709No exploit	Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attsnipeitapp · snipe-it · CWE-284 pre-auth RCE Broken access control (IDOR)	Critical9.8	—	0.8%	May 7, 2026
39Monitor	CVE-2025-63601No exploit	Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious bacsnipeitapp · snipe-it · CWE-434 RCE File upload	Critical9.9	—	0.6%	Nov 5, 2025
37Monitor	CVE-2026-86738No exploit	Snipe-IT before 8.7.0 CSS Injection via Custom CSSsnipeitapp · snipe-it · CWE-79 XSS CSRF	Critical9.3	—	0.5%	Sep 8, 2026
35Monitor	CVE-2022-23064No exploit	Snipe-IT - Host Header Injectionsnipeitapp · snipe-it · CWE-74 Pre-auth	High8.8	—	1.3%	May 2, 2022
35Monitor	CVE-2022-0611No exploit	Missing Authorization in snipe/snipe-itsnipeitapp · snipe-it · CWE-862 Broken access control (IDOR)	High8.8	—	1.2%	Feb 15, 2022
35Monitor	CVE-2021-3858No exploit	Cross-Site Request Forgery (CSRF) in snipe/snipe-itsnipeitapp · snipe-it · CWE-352 Pre-auth CSRF	High8.8	—	0.5%	Oct 19, 2021
35Monitor	CVE-2021-4130No exploit	Cross-Site Request Forgery (CSRF) in snipe/snipe-itsnipeitapp · snipe-it · CWE-352 Pre-auth CSRF	High8.8	—	0.5%	Dec 18, 2021
35Monitor	CVE-2023-5511No exploit	Cross-Site Request Forgery (CSRF) in snipe/snipe-itsnipeitapp · snipe-it · CWE-352 Pre-auth CSRF	High8.8	—	0.3%	Oct 10, 2023
34Monitor	CVE-2026-86733No exploit	Snipe-IT before 8.7.0 Remote Code Execution via Backup Restoresnipeitapp · snipe-it · CWE-78 RCE Command injection	High8.6	—	0.6%	Sep 8, 2026
34Monitor	CVE-2026-86770No exploit	Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collationsnipeitapp · snipe-it · CWE-178 Auth bypass	High8.6	—	0.6%	Sep 9, 2026
34Monitor	CVE-2026-85617No exploit	snipe-it before 8.6.3 Authorization Bypass via Bulk Deletesnipeitapp · snipe-it · CWE-639 Broken access control (IDOR)	High8.7	—	0.5%	Sep 4, 2026
34Monitor	CVE-2026-86762No exploit	Snipe-IT before 8.7.0 Authentication Bypass via API Middlewaresnipeitapp · snipe-it · CWE-862 Auth bypass Broken access control (IDOR)	High8.6	—	0.5%	Sep 9, 2026
34Monitor	CVE-2025-15602Proof of concept	Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalationsnipeitapp · snipe-it · CWE-915	High8.7	—	0.5%	Mar 6, 2026
34Monitor	CVE-2026-44832No exploit	Snipe-IT: Privilege Escalation via API Permissions Assignmentsnipeitapp · snipe-it · CWE-281	High8.7	—	0.4%	May 26, 2026
34Monitor	CVE-2024-51093No exploit	Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScripsnipeitapp · snipe-it · CWE-79 XSS	High8.7	—	0.4%	Nov 12, 2024
34Monitor	CVE-2026-86754No exploit	Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clientssnipeitapp · snipe-it · CWE-863 Broken access control (IDOR)	High8.5	—	0.3%	Sep 9, 2026
34Monitor	CVE-2026-63493No exploit	Snipe-IT: 2FA bypass via the API token flowsnipeitapp · snipe-it · CWE-288 Auth bypass	High8.6	—	0.3%	5 days ago
33Monitor	CVE-2026-85616No exploit	Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptancesnipeitapp · snipe-it · CWE-639 Broken access control (IDOR)	High8.4	—	0.4%	Sep 4, 2026
33Monitor	CVE-2026-86751No exploit	Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdownsnipeitapp · snipe-it · CWE-73 SSRF Path traversal	High8.4	—	0.4%	Sep 9, 2026
33Monitor	CVE-2026-86741No exploit	Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULAsnipeitapp · snipe-it · CWE-73 SSRF Path traversal	High8.4	—	0.4%	Sep 9, 2026
33Monitor	CVE-2026-86750No exploit	snipe-it before 8.7.0 Authorization Bypass via API User Create/Updatesnipeitapp · snipe-it · CWE-863 Broken access control (IDOR)	High8.3	—	0.3%	Sep 9, 2026
33Monitor	CVE-2026-86771No exploit	Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_numsnipeitapp · snipe-it · CWE-918 SSRF	High8.3	—	0.3%	Sep 9, 2026
33Monitor	CVE-2026-62368No exploit	Snipe-IT: Stored XSS via Custom Field name in asset-list column headerssnipeitapp · snipe-it · CWE-79 XSS	High8.4	—	0.3%	5 days ago
32Monitor	CVE-2022-2997No exploit	Session Fixation in snipe/snipe-itsnipeitapp · snipe-it · CWE-384	High8.0	—	0.9%	Aug 25, 2022
32Monitor	CVE-2024-51094No exploit	An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into snipeitapp · snipe-it · CWE-1236	High8.0	—	0.4%	Nov 12, 2024

CVE-2026-37709
39Monitor
Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote att
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Broken access control (IDOR)
snipeitapp · snipe-itMay 7, 2026
CVE-2025-63601
39Monitor
Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious bac
CriticalCVSS 9.9No exploitEPSS 1%
- RCE
- File upload
snipeitapp · snipe-itNov 5, 2025
CVE-2026-86738
37Monitor
Snipe-IT before 8.7.0 CSS Injection via Custom CSS
CriticalCVSS 9.3No exploitEPSS 0%
- XSS
- CSRF
snipeitapp · snipe-itSep 8, 2026
CVE-2022-23064
35Monitor
Snipe-IT - Host Header Injection
HighCVSS 8.8No exploitEPSS 1%
- Pre-auth
snipeitapp · snipe-itMay 2, 2022
CVE-2022-0611
35Monitor
Missing Authorization in snipe/snipe-it
HighCVSS 8.8No exploitEPSS 1%
- Broken access control (IDOR)
snipeitapp · snipe-itFeb 15, 2022
CVE-2021-3858
35Monitor
Cross-Site Request Forgery (CSRF) in snipe/snipe-it
HighCVSS 8.8No exploitEPSS 1%
- Pre-auth
- CSRF
snipeitapp · snipe-itOct 19, 2021
CVE-2021-4130
35Monitor
Cross-Site Request Forgery (CSRF) in snipe/snipe-it
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
snipeitapp · snipe-itDec 18, 2021
CVE-2023-5511
35Monitor
Cross-Site Request Forgery (CSRF) in snipe/snipe-it
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
snipeitapp · snipe-itOct 10, 2023
CVE-2026-86733
34Monitor
Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
snipeitapp · snipe-itSep 8, 2026
CVE-2026-86770
34Monitor
Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation
HighCVSS 8.6No exploitEPSS 1%
- Auth bypass
snipeitapp · snipe-itSep 9, 2026
CVE-2026-85617
34Monitor
snipe-it before 8.6.3 Authorization Bypass via Bulk Delete
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
snipeitapp · snipe-itSep 4, 2026
CVE-2026-86762
34Monitor
Snipe-IT before 8.7.0 Authentication Bypass via API Middleware
HighCVSS 8.6No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
snipeitapp · snipe-itSep 9, 2026
CVE-2025-15602
34Monitor
Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation
HighCVSS 8.7Proof of conceptEPSS 0%
snipeitapp · snipe-itMar 6, 2026
CVE-2026-44832
34Monitor
Snipe-IT: Privilege Escalation via API Permissions Assignment
HighCVSS 8.7No exploitEPSS 0%
snipeitapp · snipe-itMay 26, 2026
CVE-2024-51093
34Monitor
Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScrip
HighCVSS 8.7No exploitEPSS 0%
- XSS
snipeitapp · snipe-itNov 12, 2024
CVE-2026-86754
34Monitor
Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients
HighCVSS 8.5No exploitEPSS 0%
- Broken access control (IDOR)
snipeitapp · snipe-itSep 9, 2026
CVE-2026-63493
34Monitor
Snipe-IT: 2FA bypass via the API token flow
HighCVSS 8.6No exploitEPSS 0%
- Auth bypass
snipeitapp · snipe-it5 days ago
CVE-2026-85616
33Monitor
Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptance
HighCVSS 8.4No exploitEPSS 0%
- Broken access control (IDOR)
snipeitapp · snipe-itSep 4, 2026
CVE-2026-86751
33Monitor
Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown
HighCVSS 8.4No exploitEPSS 0%
- SSRF
- Path traversal
snipeitapp · snipe-itSep 9, 2026
CVE-2026-86741
33Monitor
Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA
HighCVSS 8.4No exploitEPSS 0%
- SSRF
- Path traversal
snipeitapp · snipe-itSep 9, 2026
CVE-2026-86750
33Monitor
snipe-it before 8.7.0 Authorization Bypass via API User Create/Update
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
snipeitapp · snipe-itSep 9, 2026
CVE-2026-86771
33Monitor
Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num
HighCVSS 8.3No exploitEPSS 0%
- SSRF
snipeitapp · snipe-itSep 9, 2026
CVE-2026-62368
33Monitor
Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
HighCVSS 8.4No exploitEPSS 0%
- XSS
snipeitapp · snipe-it5 days ago
CVE-2022-2997
32Monitor
Session Fixation in snipe/snipe-it
HighCVSS 8.0No exploitEPSS 1%
snipeitapp · snipe-itAug 25, 2022
CVE-2024-51094
32Monitor
An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into
HighCVSS 8.0No exploitEPSS 0%
snipeitapp · snipe-itNov 12, 2024