CVE-2026-55452None▾ SunlitSnipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escap…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.4%
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a formula-like User-Agent that may execute when a report viewer opens the exported CSV in spreadsheet software. This issue is fixed in version 8.5.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-14229Medium· 4.7A security vulnerability has been detected in SourceCodester Inventory Management System 1.0
CVE-2026-67187High· 7.1Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields
CVE-2026-102799Medium· 5.3Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16
CVE-2026-116649High· 7.1Tanium addressed an improper output sanitization vulnerability in Enforce.
CVE-2026-116647High· 7.1Tanium addressed an improper output sanitization vulnerability in Comply.
CVE-2026-86020Medium· 4.6Part-DB: Spreadsheet Formula Injection in XLSX Part Exports