Most recent entries from all

EUVD-2026-358421

fkie_cve-2026-61807

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a selector, concatenates countId.substring(1) into an HTML string, and passes the string to jQuery .after(). A crafted name can therefore execute JavaScript when an authenticated user views the manufacturer detail page or supplier detail page, potentially exposing data or actions available to that session. This issue is fixed in version 8.6.2.

GHSA-c8qc-wf67-342w — Snipe-IT: Stored DOM XSS via table selected-count IDs

Affected: Packagist: snipe/snipe-it

### Impact The table component derives data-selected-count-id from the component $name value. On manufacturer and supplier detail pages, stored manufacturer or supplier names are passed into affected table components as that name value. The client-side JavaScript later reads the browser-decoded data-selected-count-id, uses it as a selector, and concatenates countId.substring(1) directly into an HTML string passed to jQuery .after().

Affected commit:

`b224cc636c6780386e3f73f03d1171f52ab4c37a`

Example payload for a manufacturer or supplier name: `x[foo="><svg/onload=alert(1)>"]>`

The issue appears to involve the following flow:

Stored supplier/manufacturer name -> table component data-selected-count-id -> browser decodes the attribute -> JavaScript reads countId -> countId is used as a selector -> countId.substring(1) is concatenated into HTML -> jQuery .after() inserts attacker-controlled markup -> JavaScript executes in the victim's browser

Potential impact includes arbitrary JavaScript execution in the browser of an authenticated Snipe-IT user who views the affected supplier or manufacturer detail page. If the victim has elevated privileges, this may allow access to data or actions available to that user's session.

### Patches Patched in https://github.com/grokability/snipe-it/commit/d12ad3d53869443b96b663ba3ce2673ef343da71

WID-SEC-W-2026-2073 — Snipe-IT: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Snipe-IT ausnutzen, um Dateien zu manipulieren, um Sicherheitsvorkehrungen zu umgehen, um einen Cross-Site Scripting Angriff durchzuführen und um beliebigen Programmcode auszuführen.