CVE-2025-65622

5.4

MEDIUMCVSS v3

Published

December 1, 2025

Affected

4 projects

Assigned by

MITRE

Severity scale

010

Description

Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session.

grokability/snipe-it

GitHubA free open source IT asset/license management system

< 8.3.4NVD

snipeit

Python Package IndexPython library to access the SnipeIT API

< 8.3.4NVD

snipe/snipe-it

Docker Hub

More on this CVE

NVD↗GitHub Advisory↗

The *only* official docker hub repository for Snipe-IT from the maintainers of Snipe-IT.

< 8.3.4NVD

grokability/snipe-it

Docker HubPlease pull from snipe/snipe-it to get the latest version of the official Snipe-IT image.

< 8.3.4NVD

Security Advisories

CVE-2025-65622

Description

More on this CVE