CVE-2026-62368High· 8.1▾ MidnightPoC availableSnipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-ta…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44.6 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.3%
Last analysed / modified upstream
0.3% → 0.4%
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page associated with the fieldset, the stored markup executes on page load in that user's Snipe-IT session. This can expose same-origin data and perform authenticated actions with the victim's privileges, including privilege escalation when a superuser views the affected list. This issue is fixed in version 8.7.0.
snipe-it < 8.7.0Upgrade past the affected range:
snipe-it 8.7.0Affected packages:
snipe/snipe-it < 8.7.0Patched in:
snipe/snipe-it 8.7.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63498High· 8.7Snipe-IT is an IT asset/license management system
CVE-2026-63493High· 8.1Snipe-IT is an IT asset/license management system
CVE-2026-86772Medium· 5.4Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where department names are rendered unescaped in the fallback branch for users without departments.view permis…
CVE-2026-86738High· 8.7Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters
CVE-2026-61807Medium· 6.1Snipe-IT is an IT asset/license management system
CVE-2026-114064Medium· 5.5Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint