# Snipeitapp Snipe-It


- [CVE-2025-63601](https://insights.sbomify.com/CVE-2025-63601/): File upload in n/a (critical 9.9)
- [CVE-2026-37709](https://insights.sbomify.com/CVE-2026-37709/): Snipe-IT has insecure permissions in file uploads (critical 9.8)
- [CVE-2026-86738](https://insights.sbomify.com/CVE-2026-86738/): Snipe-IT before 8.7.0 CSS Injection via Custom CSS (critical 9.3)
- [CVE-2026-116199](https://insights.sbomify.com/CVE-2026-116199/): Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback (critical 9.2)
- [CVE-2022-1380](https://insights.sbomify.com/CVE-2022-1380/): Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it (critical 9.1)
- [CVE-2022-1445](https://insights.sbomify.com/CVE-2022-1445/): Stored Cross Site Scripting vulnerability in the checked_out_to parameter in snipe/snipe-it (critical 9.0)
- [CVE-2022-23064](https://insights.sbomify.com/CVE-2022-23064/): Snipe-IT - Host Header Injection (high 8.8)
- [CVE-2026-116201](https://insights.sbomify.com/CVE-2026-116201/): Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition (high 8.7)
- [CVE-2026-63498](https://insights.sbomify.com/CVE-2026-63498/): Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API (high 8.7)
- [CVE-2026-85617](https://insights.sbomify.com/CVE-2026-85617/): snipe-it before 8.6.3 Authorization Bypass via Bulk Delete (high 8.7)
- [CVE-2026-44832](https://insights.sbomify.com/CVE-2026-44832/): Snipe-IT: Privilege Escalation via API Permissions Assignment (high 8.7)
- [CVE-2025-15602](https://insights.sbomify.com/CVE-2025-15602/): Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/products/snipeitapp/snipe-it/