Components Vulnerabilities Pricing MCP API

snipe/snipe-it v8.1.0 | Vulnerabilities | Sonatype Guide

snipe-it

v8.1.0

snipe-it v8.1.0

snipe

PublishedApr 29, 2025•Policy

compliance

composer Registry

Developer Trust Score

N/A

Recommended Version:x.y.z

Latest version with 0 known vulnerabilities that meets your policy.

Compare Versions

Severity

Critical (1)

High (6)

Medium (23)

Low (0)

CVSS Score

0.010.0

EPSS Score

0.01.0

Malware

KEV StatusPublished

8.8CVE-2025-15602

Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.

PublishedMar 10, 2026

4.8CVE-2026-24040

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g., a Node.js web server), this variable is shared across all requests. If multiple requests generate PDFs simultaneously, the JavaScript content intended for one user may be overwritten by a subsequent request before the document is generated. This results in Cross-User Data Leakage, where the PDF generated for User A contains the JavaScript payload (and any embedded sensitive data) intended for User B. Typically, this only affects server-side environments, although the same race conditions might occur if jsPDF runs client-side. The vulnerability has been fixed in jsPDF@4.1.0.

5.4CVE-2025-65622

Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session.

PublishedDec 4, 2025

5.4CVE-2025-65621

Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.

PublishedDec 3, 2025

5.3CVE-2025-63601

Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands.

PublishedNov 6, 2025

5.4CVE-2025-59712

Snipe-IT before 8.1.18 allows XSS.

PublishedSep 24, 2025

8.1CVE-2025-59713

Snipe-IT before 8.1.18 allows unsafe deserialization.

PublishedSep 24, 2025

6.9sonatype-2024-011918

jquery-ui - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

6.1CVE-2019-11358

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

4.8CVE-2022-32060

An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.

PublishedJul 11, 2022

4.8CVE-2022-32061

An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.

PublishedJul 11, 2022

5.4CVE-2022-1291

XSS vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. Transmitting cookies to third-party servers. Sending data from secure sessions to third-party servers

PublishedApr 11, 2022

7.5CVE-2022-24785

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

6.1CVE-2021-41182

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.

6.1CVE-2021-41184

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

6.1CVE-2021-41183

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.

4.3sonatype-2020-1612

jquery-ui - Missing Release of Memory after Effective Lifetime

PublishedSep 6, 2021

9.8sonatype-2020-1023

Chart.js - Prototype Pollution

SeverityCritical

PublishedOct 20, 2020

6.1CVE-2020-7691

In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex.

PublishedJul 7, 2020

6.1CVE-2020-7690

All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method.

PublishedJul 7, 2020

6.1CVE-2020-11023EXPLOITED

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

6.1sonatype-2020-0187

jQuery - Cross-Site Scripting (XSS)

6.5sonatype-2018-0512

tableExport.jquery.plugin - Code Injection via formulas in cell strings

PublishedMay 6, 2019

7.5sonatype-2017-0422

moment - Regular Expression Denial of Service (ReDoS)

6.5sonatype-2017-0337

jquery-typeahead - Cross-Site Scripting (XSS)

PublishedAug 31, 2017

1-25 of 30

PublishedFeb 4, 2026

Published

Oct 31, 2024

Published

Jul 29, 2022

PublishedApr 4, 2022

PublishedOct 26, 2021

PublishedOct 26, 2021

PublishedOct 26, 2021

PublishedApr 30, 2020

Apr 14, 2020

Published

Dec 7, 2017