https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 21:02:04 +0000 https://vulnerability.circl.lu/vuln/cve-2025-63743 <p>Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated attacker with lowest privileges sufficient only to log in, to inject arbitrary JavaScript code via &#34;Name&#34; and &#34;Surname&#34; fields. The JavaScript code is executed whenever &#34;Activity Report&#34; or modified profile is viewed directly by any user with sufficient permissions. Successful exploitation of this issue requires that the profile&#39;s &#34;Display Name&#34; is not set. The vulnerability is fixed in v8.3.2.</p> <p>Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated attacker with lowest privileges sufficient only to log in, to inject arbitrary JavaScript code via &#34;Name&#34; and &#34;Surname&#34; fields. The JavaScript code is executed whenever &#34;Activity Report&#34; or modified profile is viewed directly by any user with sufficient permissions. Successful exploitation of this issue requires that the profile&#39;s &#34;Display Name&#34; is not set. The vulnerability is fixed in v8.3.2.</p> https://vulnerability.circl.lu/vuln/cve-2025-63743