Composer snipe/snipe-it has 81 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2022-23064 | snipe-IT vulnerable to host header injection | high | 8.8 | >=3.0-alpha and <5.3.8 | 5.3.8 |
| CVE-2025-47226 | Grokability Snipe-IT has incorrect authorization for accessing asset information | medium | 5.0 | <8.1.0 | 8.1.0 |
| CVE-2022-0611 | Improper Privilege Management in Snipe-IT | high | 8.8 | <5.3.11 | 5.3.11 |
| CVE-2022-32060 | Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings | medium | 4.8 | <=6.0.2 | – |
| CVE-2022-1511 | Improper Access Control in snipe/snipe-it | medium | 6.5 | <5.4.4 | 5.4.4 |
| CVE-2022-0579 | Improper Privilege Management in Snipe-IT | medium | 6.5 | <5.3.9 | 5.3.9 |
| CVE-2022-0569 | Exposure of Sensitive Information in snipe/snipe-it | medium | 4.3 | <5.3.10 | 5.3.10 |
| CVE-2022-1155 | Old sessions not blocked by login enable function in Snipe-IT | high | 7.4 | >=6.0.0-RC-1 and <6.0.0-RC-6 or <5.4.2 | 6.0.0-RC-6, 5.4.2 |
| CVE-2024-48987 | Snipe-IT remote code execution | high | 7.2 | <7.0.10 | 7.0.10 |
| CVE-2022-0622 | Generation of Error Message Containing Sensitive Information in Snipe-IT | medium | 5.3 | <5.3.11 | 5.3.11 |
| CVE-2022-2997 | Insufficient Session Expiration in snipe/snipe-it | medium | 4.6 | <6.0.10 | 6.0.10 |
| CVE-2021-4075 | Server-Side Request Forgery in snipe/snipe-it | high | 7.2 | <6.0.0-GM | 6.0.0-GM |
| CVE-2022-3173 | Snipe-IT vulnerable to Improper Authentication | medium | 4.3 | <6.0.10 | 6.0.10 |
| CVE-2019-10118 | Snipe-IT XSS Vulnerability | medium | 6.1 | <4.6.14 | 4.6.14 |
| CVE-2022-1380 | Cross-site Scripting in snipe-it | medium | 5.4 | <5.4.3 | 5.4.3 |
| CVE-2021-3879 | Cross-site Scripting in snipe-it | medium | 6.8 | <5.3.0 | 5.3.0 |
| CVE-2021-4108 | snipe-it is vulnerable to Cross-site Scripting | medium | 6.4 | <5.3.5 | 5.3.5 |
| CVE-2021-3863 | Cross-site Scripting in snipe-it | medium | 5.5 | <5.3.0 | 5.3.0 |
| CVE-2022-1445 | Stored cross-site scripting in Snipe-IT | medium | 5.4 | <5.4.3 | 5.4.3 |
| CVE-2021-3961 | Cross-site Scripting in snipe/snipe-it | high | 8.0 | <5.3.2 | 5.3.2 |
| CVE-2022-3035 | snipe-it vulnerable to cross-site scripting (XSS) | medium | 4.8 | <6.0.11 | 6.0.11 |
| CVE-2021-4089 | snipe-it is vulnerable to Improper Access Control | medium | 4.3 | <5.3.4 | 5.3.4 |
| CVE-2022-32061 | Snipe-IT 6.0.2 vulnerable to Cross-site Scripting | medium | 4.8 | <=6.0.2 | – |
| CVE-2022-44381 | Snipe-IT allows attackers to check whether a user account exists | medium | 5.3 | <=6.0.14 | – |
| CVE-2021-4018 | snipe-it is vulnerable to Cross-site Scripting | medium | 5.4 | <5.3.3 | 5.3.3 |
| CVE-2022-0179 | Incorrect Default Permissions and Improper Access Control in snipe-it | medium | 5.4 | <5.3.7 | 5.3.7 |
| CVE-2023-5452 | Cross-site Scripting in snipe/snipe-it | medium | 5.4 | <6.2.2 | 6.2.2 |
| CVE-2026-37709 | Snipe-IT has insecure permissions in file uploads | critical | 9.8 | <8.4.1 | 8.4.1 |
| CVE-2026-55469 | Snipe-IT has a path traversal vulnerability via CSV import `image` field | low | 0.0 | <8.6.2 | 8.6.2 |
| CVE-2022-0178 | Improper Access Control in snipe-it | medium | 5.4 | <5.3.8 | 5.3.8 |
| CVE-2021-3858 | Cross-Site Request Forgery in snipe-it | medium | 4.3 | <5.3.0 | 5.3.0 |
| CVE-2026-55843 | Snipe-IT has an Improper Privilege Management issue | medium | 6.5 | <8.6.0 | 8.6.0 |
| CVE-2021-3938 | snipe-it is vulnerable to Cross-site Scripting | low | 3.9 | <5.4.0 | 5.4.0 |
| CVE-2022-44380 | Snipe-IT vulnerable to Cross Site Scripting for View Assigned Assets | medium | 5.4 | <6.0.14 | 6.0.14 |
| CVE-2026-49976 | Snipe-IT Vulnerable to User Account Escalation via CSV Import | medium | 6.5 | <8.6.0 | 8.6.0 |
| CVE-2026-55474 | Snipe-IT vulnerable to directory traversal in displaySig | high | 0.0 | <8.5.0 | 8.5.0 |
| CVE-2021-4130 | snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) | high | 8.8 | <5.3.6 | 5.3.6 |
| CVE-2025-15602 | Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment | high | 8.8 | <8.3.7 | 8.3.7 |
| CVE-2021-3931 | snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 4.3 | <=5.3.1 | – |
| CVE-2026-55466 | Snipe-IT vulnerable to stored XSS via inline-served attachment | high | 8.7 | <8.6.2 | 8.6.2 |
| CVE-2026-55460 | Snipe-IT has an authorization bypass on bulk editing users | high | 7.1 | <8.6.2 | 8.6.2 |
| CVE-2024-51093 | Cross Site Scripting vulnerability in Snipe-IT | high | 8.7 | <=7.0.13 | – |
| CVE-2026-55452 | Snipe-IT has CSV formula injection in Activity Report export | medium | 0.0 | <8.6.2 | 8.6.2 |
| CVE-2024-5685 | Snipe-IT allows users to promote or demote themselves or other users | high | 8.1 | <6.4.2 | 6.4.2 |
| CVE-2026-49870 | Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor` | medium | 5.9 | <8.6.0 | 8.6.0 |
| CVE-2026-54329 | Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection | high | 8.5 | <8.6.2 | 8.6.2 |
| CVE-2026-48492 | Snipe-IT's selectlist visibility is too permissive | medium | 0.0 | <8.5.1 | 8.5.1 |
| CVE-2025-59713 | Snipe-IT allows unsafe deserialization | medium | 6.8 | <8.1.18 | 8.1.18 |
| CVE-2026-55516 | Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update | high | 7.7 | <8.6.2 | 8.6.2 |
| CVE-2026-55519 | Snipe-IT has Improper Authorization in File Deletion (IDOR) | low | 0.0 | <8.4.1 | 8.4.1 |
| CVE-2026-62368 | Snipe-IT: Stored XSS via Custom Field name in asset-list column headers | high | 8.1 | <8.7.0 | 8.7.0 |
| CVE-2026-55483 | Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation | medium | 0.0 | <8.6.0 | 8.6.0 |
| CVE-2026-55475 | Snipe-IT's import created_by can be overwritten | medium | 5.7 | <8.6.1 | 8.6.1 |
| CVE-2026-55462 | Snipe-IT has an authorization bypass on print inventory page | medium | 4.3 | <8.6.1 | 8.6.1 |
| CVE-2026-55703 | Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET | medium | 4.3 | <8.6.3 | 8.6.3 |
| CVE-2026-55515 | Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint | medium | 5.0 | <8.6.2 | 8.6.2 |
| CVE-2026-55476 | Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter | medium | 0.0 | <8.6.0 | 8.6.0 |
| CVE-2026-55482 | Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update | medium | 6.3 | <8.4.2 | 8.4.2 |
| CVE-2026-55472 | Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation | medium | 4.3 | <8.6.2 | 8.6.2 |
| CVE-2026-55479 | Snipe-IT has incorrect permission for legacy license checkin API | medium | 0.0 | <8.6.2 | 8.6.2 |
| CVE-2026-63493 | Snipe-IT: 2FA bypass via the API token flow | high | 0.0 | <8.7.0 | 8.7.0 |
| CVE-2026-44832 | Snipe-IT has Privilege Escalation via API Permissions Assignment | high | 8.8 | <8.4.1 | 8.4.1 |
| CVE-2026-55481 | Snipe-IT has CSS Injection via `header_color` Setting | medium | 0.0 | <8.6.2 | 8.6.2 |
| CVE-2026-55461 | Snipe-IT has an Open Redirect After User Edit | medium | 6.1 | <8.6.2 | 8.6.2 |
| CVE-2026-48493 | Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment | medium | 5.5 | <8.6.0 | 8.6.0 |
| CVE-2023-5511 | Cross-Site Request Forgery (CSRF) in snipe/snipe-it | high | 8.8 | <6.2.3 | 6.2.3 |
| CVE-2026-55643 | Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode | high | 0.0 | <8.6.3 | 8.6.3 |
| CVE-2026-55464 | Snipe-IT vulnerable to stored XSS via Markdown custom field | medium | 5.4 | <8.6.2 | 8.6.2 |
| CVE-2026-55478 | Snipe-IT has missing object-level authorization in Kits API | medium | 0.0 | <8.6.2 | 8.6.2 |
| CVE-2026-55694 | Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover | high | 0.0 | <8.6.3 | 8.6.3 |
| CVE-2026-55542 | Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL | low | 0.0 | <8.5.1 | 8.5.1 |
| CVE-2026-50550 | Snipe-IT has a 2FA reset privilege bypass | medium | 5.8 | <8.5.0 | 8.5.0 |
| CVE-2025-59712 | Snipe-IT allows XSS | medium | 6.4 | <8.1.18 | 8.1.18 |
| CVE-2025-64027 | Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow | medium | 0.0 | <=8.3.4 | – |
| CVE-2026-63498 | Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API | high | 8.7 | <8.7.0 | 8.7.0 |
| CVE-2026-48507 | Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users | high | 7.1 | <8.6.0 | 8.6.0 |
| CVE-2026-44831 | Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0) | medium | 4.8 | <8.4.1 | 8.4.1 |
| CVE-2026-61807 | Snipe-IT: Stored DOM XSS via table selected-count IDs | medium | 0.0 | <8.6.2 | 8.6.2 |
| CVE-2025-65622 | Snipe-IT allows stored XSS via the Locations "Country" field | medium | 0.0 | <8.3.4 | 8.3.4 |
| CVE-2025-65621 | Snipe-IT is vulnerable to stored cross-site scripting | medium | 5.4 | <8.3.4 | 8.3.4 |
| CVE-2026-44833 | Snipe-IT has an open redirect vulnerability | medium | 5.9 | <8.4.1 | 8.4.1 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked