---
id: CVE-2019-25264
title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting
summary: >-
  Snipe-IT 4.7.5 contains a persistent cross-site scripting vulnerability that
  allows authorized users to upload malicious SVG files with embedded
  JavaScript. Attackers can craft SVG files with script tags to execute
  arbitrary JavaScript w…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: Snipeitapp
product: IT Open Source Asset Management
affected:
  - it_open_source_asset_management 4.7.5
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-02-04T18:43:31.544851Z'
exploitAvailable: true
published: '2026-02-03'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T13:59:39.372Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2019-25264'
references:
  - url: 'https://www.exploit-db.com/exploits/47756'
    label: ExploitDB-47756
  - url: 'https://snipeitapp.com/'
    label: Official Vendor Homepage
  - url: 'https://github.com/snipe/snipe-it/releases/tag/v4.7.5'
    label: Snipe-IT v4.7.5 Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/snipe-it-open-source-asset-management-persistent-cross-site-scripting
    label: >-
      VulnCheck Advisory: Snipe-IT Open Source Asset Management 4.7.5 -
      Persistent Cross-Site Scripting
tags:
  - cve.org
  - exploit-available
epss: 0.00289
epssPercentile: 0.21555
ingestedAt: '2026-11-08T14:51:22.491Z'
---

## Overview

Snipe-IT 4.7.5 contains a persistent cross-site scripting vulnerability that allows authorized users to upload malicious SVG files with embedded JavaScript. Attackers can craft SVG files with script tags to execute arbitrary JavaScript when the accessory is viewed by other users.

## Affected

- `it_open_source_asset_management 4.7.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.