Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY

Snipe-IT 8.6.3 Race Condition via Consumable Checkout

Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint

Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components

Snipe-IT before 8.7.0 License Key Exposure via CSV Export

Snipe-IT before 8.7.0 Information Disclosure via Custom Fields

Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export

Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report

Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence

Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field

Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

Snipe-IT: User Account Escalation via CSV Import

Snipe-IT: Path traversal vulnerability via CSV import `image` field

Snipe-IT: Improper Privilege Management

Snipe-IT: Directory traversal in displaySig

Snipe-IT's selectlist visibility is too permissive

An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive…

Missing Authorization in snipe/snipe-it

Missing Authorization in snipe/snipe-it

Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay

Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy

snipe-it before 8.7.0 Data Loss via Failed Image Write

Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update

Snipe-IT: 2FA reset privilege bypass

Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState

Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive

Snipe-IT: Stored DOM XSS via table selected-count IDs

Snipe-IT: Open Redirect After User Edit

Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow

Cross-site Scripting (XSS) - Stored in snipe/snipe-it

Cross-site Scripting (XSS) - Generic in snipe/snipe-it

Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API

Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()

Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

Snipe-IT: Import created_by can be overwritten

Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout

Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints

Snipe-IT 8.6.3 Stored XSS via Department Names

Snipe-IT before 8.7.0 Improper Input Validation via API Checkout

snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag

Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth

snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints

snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User

Snipe-IT: Improper Authorization in File Deletion (IDOR)

Snipe-IT Checkout Request Cancellation IDOR

Snipe-IT: Stored XSS via Markdown custom field

Snipe-IT: Missing object-level authorization in Kits API

Snipe-IT: XSS vulnerability in component notes