Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
139 results · page 3 of 3
Sep 18, 2025Snipe-IT before 8.1.18 allows XSS.CVE-2025-59712 · Other software · snipeitapp · reported by MITREMedium 6.4
Snipe-IT before 8.1.18 allows XSS.
- Product
- Snipe-IT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2025Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.CVE-2025-47226 · Other software · snipeitapp · reported by MITREMedium 5
Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.
- Product
- Snipe-IT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field.CVE-2024-51094 · Other software · snipeitapp · reported by MITREHigh 8
An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be executed, allowing the attacker to exfiltrate internal system data from the CSV file to a remote server.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.githubusercontent.com
Nov 12, 2024Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code.CVE-2024-51093 · Other software · snipeitapp · reported by MITREHigh 8.7
Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. This can lead to privilege escalation when the payload is executed, granting the attacker super admin permissions within the Snipe-IT system.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.githubusercontent.com
Oct 11, 2024Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY.CVE-2024-48987 · Other software · snipeitapp · reported by MITREMedium 6.6
Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsynacktiv.com
Jun 14, 2024Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.CVE-2024-5685 · Other software · snipe · reported by 596c5446-0ce5-4ba2-aa66-48b3b757a647High 7.6
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.checkmarx.netdevhub.checkmarx.com
Oct 10, 2023Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.CVE-2023-5511 · Other software · snipe · reported by security@huntr.devHigh 8.8
Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2.CVE-2023-5452 · Other software · snipe · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.CVE-2022-44381 · Other software · Snipeitapp · reported by MITREMedium 5.3
Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.
- Product
- Snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcensus-labs.comcensus-labs.com
Dec 25, 2022Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.CVE-2022-44380 · Other software · Snipeitapp · reported by MITREMedium 5.4
Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.
- Product
- Snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcensus-labs.comcensus-labs.com
Sep 17, 2022Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10.CVE-2022-3173 · Other software · snipe · reported by security@huntr.devMedium 4.3
Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.0.11.CVE-2022-3035 · Other software · snipe · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.0.11.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10.CVE-2022-2997 · Other software · snipe · reported by security@huntr.devHigh 8
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2022An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary codeCVE-2022-32061 · Other software · Snipeitapp · reported by MITREMedium 4.8
An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.
- Product
- Snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrimthereaperteam.medium.comgrimthereaperteam.medium.com
Jul 7, 2022An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted filCVE-2022-32060 · Other software · Snipeitapp · reported by MITREMedium 4.8
An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.
- Product
- Snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgrimthereaperteam.medium.com
May 2, 2022In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection.CVE-2022-23064 · Other software · snipe · reported by vulnerabilitylab@mend.ioHigh 8.8
In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Apr 28, 2022Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4.CVE-2022-1511 · Other software · snipe · reported by security@huntr.devMedium 6.5
Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2022Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe/snipe-it prior to 5.4.3.CVE-2022-1445 · Other software · snipe · reported by security@huntr.devMedium 5.4
Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe/snipe-it prior to 5.4.3. The vulnerability is capable of stolen the user Cookie.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2022Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3.CVE-2022-1380 · Other software · snipe · reported by security@huntr.devMedium 5.4
Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2022Old sessions are not blocked by the login enable function.CVE-2022-1155 · Other software · snipe · reported by security@huntr.devHigh 7.4
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2022Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11.CVE-2022-0622 · Other software · snipe · reported by security@huntr.devMedium 5.3
Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11.CVE-2022-0611 · Other software · snipe · reported by security@huntr.devMedium 6.3
Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9.CVE-2022-0579 · Other software · snipe · reported by security@huntr.devMedium 6.5
Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9.CVE-2022-0569 · Other software · snipe · reported by security@huntr.devMedium 5.3
Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2022Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8.CVE-2022-0178 · Other software · snipe · reported by security@huntr.devMedium 6.3
Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2022snipe-it is vulnerable to Missing AuthorizationCVE-2022-0179 · Other software · snipe · reported by security@huntr.devMedium 5.4
snipe-it is vulnerable to Missing Authorization
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2021snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-4130 · Other software · snipe · reported by security@huntr.devHigh 8.8
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4108 · Other software · snipe · reported by security@huntr.devMedium 6.1
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2021snipe-it is vulnerable to Improper Access ControlCVE-2021-4089 · Other software · snipe · reported by security@huntr.devMedium 4.3
snipe-it is vulnerable to Improper Access Control
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2021snipe-it is vulnerable to Server-Side Request Forgery (SSRF)CVE-2021-4075 · Other software · snipe · reported by security@huntr.devHigh 7.2
snipe-it is vulnerable to Server-Side Request Forgery (SSRF)
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2021snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4018 · Other software · snipe · reported by security@huntr.devMedium 5.4
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2021snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3961 · Other software · snipe · reported by security@huntr.devMedium 5.4
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2021snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3938 · Other software · snipe · reported by security@huntr.devMedium 5.4
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2021snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-3931 · Other software · snipe · reported by security@huntr.devMedium 4.3
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2021snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3879 · Other software · snipe · reported by security@huntr.devMedium 5.4
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2021snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3863 · Other software · snipe · reported by security@huntr.devMedium 6.1
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2021snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-3858 · Other software · snipe · reported by security@huntr.devHigh 8.8
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2019Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.CVE-2019-10118 · Other software · Snipeitapp · reported by MITREMedium 6.1
Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.
- Product
- Snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2019In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS.CVE-2016-10744 · Other software · Select2 · reported by MITREMedium 6.1
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.
- Product
- Select2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.