Components Vulnerabilities Pricing MCP API

snipe/snipe-it v8.1.17 | Vulnerabilities | Sonatype Guide

snipe-it

v8.1.17

snipe-it v8.1.17

snipe

PublishedJun 30, 2025•Policy

compliance

composer Registry

Developer Trust Score

N/A

Recommended Version:x.y.z

Latest version with 0 known vulnerabilities that meets your policy.

Compare Versions

Severity

Critical (1)

High (6)

Medium (23)

Low (0)

CVSS Score

0.010.0

EPSS Score

0.01.0

Malware

KEV StatusPublished

8.8CVE-2025-15602

Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.

Published

Mar 10, 2026

4.8CVE-2026-24040

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g., a Node.js web server), this variable is shared across all requests. If multiple requests generate PDFs simultaneously, the JavaScript content intended for one user may be overwritten by a subsequent request before the document is generated. This results in Cross-User Data Leakage, where the PDF generated for User A contains the JavaScript payload (and any embedded sensitive data) intended for User B. Typically, this only affects server-side environments, although the same race conditions might occur if jsPDF runs client-side. The vulnerability has been fixed in jsPDF@4.1.0.

PublishedFeb 4, 2026

5.4CVE-2025-65622

Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session.

PublishedDec 4, 2025

5.4CVE-2025-65621

Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.

PublishedDec 3, 2025

5.3CVE-2025-63601

Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands.

PublishedNov 6, 2025

5.4CVE-2025-59712

Snipe-IT before 8.1.18 allows XSS.

PublishedSep 24, 2025

8.1CVE-2025-59713

Snipe-IT before 8.1.18 allows unsafe deserialization.

PublishedSep 24, 2025

6.9sonatype-2024-011918

jquery-ui - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

PublishedOct 31, 2024

6.1CVE-2019-11358

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

PublishedJul 29, 2022

4.8CVE-2022-32060

An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.

PublishedJul 11, 2022

4.8CVE-2022-32061

An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.

PublishedJul 11, 2022

5.4CVE-2022-1291

XSS vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. Transmitting cookies to third-party servers. Sending data from secure sessions to third-party servers

PublishedApr 11, 2022

7.5CVE-2022-24785

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

PublishedApr 4, 2022

6.1CVE-2021-41182

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.

PublishedOct 26, 2021

6.1CVE-2021-41184

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

PublishedOct 26, 2021

6.1CVE-2021-41183

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.

PublishedOct 26, 2021

4.3sonatype-2020-1612

jquery-ui - Missing Release of Memory after Effective Lifetime

PublishedSep 6, 2021

9.8sonatype-2020-1023

Chart.js - Prototype Pollution

SeverityCritical

PublishedOct 20, 2020

6.1CVE-2020-7691

In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex.

PublishedJul 7, 2020

6.1CVE-2020-7690

All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method.

PublishedJul 7, 2020

6.1CVE-2020-11023EXPLOITED

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

PublishedApr 30, 2020

6.1sonatype-2020-0187

jQuery - Cross-Site Scripting (XSS)

PublishedApr 14, 2020

6.5sonatype-2018-0512

tableExport.jquery.plugin - Code Injection via formulas in cell strings

PublishedMay 6, 2019

7.5sonatype-2017-0422

moment - Regular Expression Denial of Service (ReDoS)

PublishedDec 7, 2017

6.5sonatype-2017-0337

jquery-typeahead - Cross-Site Scripting (XSS)

PublishedAug 31, 2017

1-25 of 30