What’s Vulnerable › Vulnerabilities

CVE-2022-3035: Cross-site Scripting (XSS) - Stored in snipe/snipe-it

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-08-29 · updated 2026-06-17
• Weakness: CWE-79

Description

Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.0.11.

Affected products

• grokability snipe-it: before 6.0.11 — fixed in 6.0.11

How to fix

Upgrade to a fixed version: grokability snipe-it 6.0.11. Check the vendor advisory for mitigations.

References

• https://github.com/snipe/snipe-it/commit/9cf5f30c77df6ab60baab1c0e6bb0b4e773f0eae
• https://huntr.dev/bounties/0bbb1046-ea9e-4cb9-bc91-b294a72d1902
• https://github.com/snipe/snipe-it/commit/9cf5f30c77df6ab60baab1c0e6bb0b4e773f0eae
• https://huntr.dev/bounties/0bbb1046-ea9e-4cb9-bc91-b294a72d1902

Get alerted when CVE-2022-3035 or the next vulnerability affects your stack