Snipeitapp Snipe-IT 7.0.13

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:snipeitapp:snipe-it:7.0.13:*:*:*:*:*:*:*

part: a version: 7.0.13 update: *

VendorSnipeitapp (53968876-973b-587f-9ac2-40247a674b04)
ProductSnipe It (97769d3b-c066-533f-9c80-98d7f0529e4a)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:docker/snipe/snipe-it purl2cpe 2026-06-01 10:16:10.238095
pkg:github/snipe/snipe-it purl2cpe 2026-06-01 10:16:10.238097
pkg:rpm/opensuse/snipe-it purl2cpe 2026-06-01 10:16:10.238098

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-51094 vulnerable 2026-06-08 06:52:11.680567 Details available
An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be executed, allowing the attacker to exfiltrate internal system data from the CSV file to a remote server.
Published: 2024-11-12T00:00:00.000Z
Updated: 2024-11-19T16:48:56.392Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-51093 vulnerable 2026-06-08 06:52:11.680161 Details available
Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. This can lead to privilege escalation when the payload is executed, granting the attacker super admin permissions within the Snipe-IT system.
Published: 2024-11-12T00:00:00.000Z
Updated: 2024-11-21T18:10:21.900Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.