PT-2026-32381 · Snipe-It · Snipe-It

CVE-2025-63743 · Published 2026-04-13 · Updated 2026-04-13

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Snipe-IT versions 8.3.0 through 8.3.1

Description A Cross-Site Scripting issue allows an authenticated attacker with minimum privileges to inject arbitrary JavaScript code through the Name and Surname fields. This code executes when a user with appropriate permissions views the modified profile or the Activity Report. This occurs only if the Display Name of the profile is not configured.

Recommendations Update versions 8.3.0 through 8.3.1 to version 8.3.2. As a temporary workaround, restrict the use of the Name and Surname fields to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-63743

Affected Products

Snipe-It

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/63xxx/CVE-2025-63743.json · Exploit
• 🔥 https://github.com/mikust/CVEs/tree/main/CVE-2025-63743 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63743 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63743 · Vendor Advisory
• https://github.com/grokability/snipe-it/commit/b6d397bcca4e8a05176b782de769d7160058bfc4#diff-7fe056d76c09808dac923c4639161d587c3fff281a01122f3e10c4a781674a65 · Note
• http://snipe-it.com · Note
• https://twitter.com/CVEnew/status/2043733074366869986 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2043785923398111344 · Twitter Post
• http://grokability.com · Note