snipeitapp

7 records · 7 with a public proof-of-concept

Disclosed vulnerabilities where the NVD names snipeitapp as an affected vendor, highest CVSS first.

  1. HIGH 8.8CVE-2026-116201public PoC2026-10-25

    Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured a…

    snipe-it

    AI risk analysis on Exploit-DB.ai →

  2. HIGH 8.7CVE-2026-63498public PoC2026-09-24

    Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with …

    snipe-it

    AI risk analysis on Exploit-DB.ai →

  3. HIGH 8.1CVE-2026-116199public PoC2026-10-25

    Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames an…

    snipe-it

    AI risk analysis on Exploit-DB.ai →

  4. HIGH 8.1CVE-2026-63493public PoC2026-09-24

    Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwo…

    snipe-it

    AI risk analysis on Exploit-DB.ai →

  5. HIGH 8.1CVE-2026-62368public PoC2026-09-24

    Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When …

    snipe-it

    AI risk analysis on Exploit-DB.ai →

  6. MEDIUM 5.9CVE-2026-116200public PoC2026-10-25

    Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-u…

    snipe-it

    AI risk analysis on Exploit-DB.ai →

  7. MEDIUM 4.3CVE-2026-116198public PoC2026-10-25

    Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encrypted_custom_fields. Authenticated API users without that permi…

    snipe-it

    AI risk analysis on Exploit-DB.ai →