CVE-2025-65621
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
51/100
Published: 2025-12-01
Modified: 2026-11-04
First seen: 2026-11-04
Status: active
Attack Surface
Network
Low Complexity
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
Required
S:
Changed
C:
Low
I:
Low
A:
None
Description
Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| snipeitapp | snipe-it | < 8.3.4 |
References & Advisories (1)
Exploit
Third Party Advisory