Stored XSS Vulnerability in Snipe-IT by Snipe-IT Team
CVE-2025-65622

5.4MEDIUM

Key Information:

Vendor

Snipe-IT Team

Status
Snipe-IT
Vendor
CVE Published:
1 December 2025

What is CVE-2025-65622?

Snipe-IT versions before 8.3.4 are vulnerable to stored Cross-Site Scripting (XSS) attacks through the 'Country' field in the Locations feature. This vulnerability allows an authenticated low-privileged user to inject malicious JavaScript code, which can then execute in the context of another user's session, potentially compromising sensitive data or user actions. Effective remediation and updates are crucial to protect against this threat. For more details, visit the official Snipe-IT website or refer to the vulnerability research repository.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

http://snipeitapp.com
https://github.com/firef0x00/vulnerability-research/tree/...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.