CVE-2025-65622
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
51/100
Published: 2025-12-01
Modified: 2026-11-04
First seen: 2026-11-04
Status: active
Attack Surface
Network
Low Complexity
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
Required
S:
Changed
C:
Low
I:
Low
A:
None
Description
Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| snipeitapp | snipe-it | < 8.3.4 |
References & Advisories (1)
Exploit
Third Party Advisory