CVE-2026-61807

Katalog CVE

CVSS 6.1 · Medium EPSS 0,21%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada snipeitapp snipe-it. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a selector, concatenates countId.substring(1) into an HTML string, and passes the string to jQuery .after(). A crafted name can therefore execute JavaScript when an authenticated user views the manufacturer detail page or supplier detail page, potentially exposing data or actions available to that session. This issue is fixed in version 8.6.2.

Rincian

Terbit di NVD

19 Agustus 2026

Terakhir diubah

30 September 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/grokability/snipe-it/security/advisories/GHSA-c8qc-wf67-342w exploit · patch · advisory vendor
• https://github.com/grokability/snipe-it/commit/d12ad3d53869443b96b663ba3ce2673ef343da71 patch
• https://github.com/grokability/snipe-it/releases/tag/v8.6.2 release notes · patch