PT-2026-5800 · Snipeitapp+1 · It Open Source Asset Management+1

Published 2026-02-03 · Updated 2026-02-03 · CVE-2019-25264

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Snipe-IT version 4.7.5

Description A persistent cross-site scripting issue allows authorized users to upload malicious SVG files containing embedded JavaScript. An attacker can craft these SVG files with script tags to execute arbitrary JavaScript in the browser of other users when they view the accessory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25264

Affected Products

It Open Source Asset Management

Snipe-It

References · 6

• 🔥 https://exploit-db.com/exploits/47756 · Exploit
• https://github.com/snipe/snipe-it/releases/tag/v4.7.5 · Patch
• https://osv.dev/vulnerability/CVE-2019-25264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25264 · Security Note
• https://snipeitapp.com · Note
• https://vulncheck.com/advisories/snipe-it-open-source-asset-management-persistent-cross-site-scripting · Note