https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 21:57:47 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-62368 <p>Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page associated with the fieldset, the stored markup executes on page load in that user&#39;s Snipe-IT session. This can expose same-origin data and perform authenticated actions with the victim&#39;s privileges, including privilege escalation when a superuser views the affected list. This issue is fixed in version 8.7.0.</p> <p>Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page associated with the fieldset, the stored markup executes on page load in that user&#39;s Snipe-IT session. This can expose same-origin data and perform authenticated actions with the victim&#39;s privileges, including privilege escalation when a superuser views the affected list. This issue is fixed in version 8.7.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-62368 https://db.gcve.eu/vuln/ghsa-p9h3-gvpq-5539 <p><strong>Affected:</strong> Packagist: snipe/snipe-it</p> <p>### Impact A user with the &#34;customfields.create&#34; permission can store HTML/JS in a Custom Field name, which is later rendered as an asset-list column title WITHOUT escaping at app/Presenters/AssetPresenter.php line 364 (&#39;title&#39; =&gt; $field-&gt;name) and injected into the table header by the bundled bootstrap-table plugin. It executes for anyone who opens an asset list (e.g. /hardware), including superusers, on page load with no interaction. Since &#34;customfields.create&#34; can be granted to non-superusers, a lower-privileged user gets script execution in a superuser&#39;s session -&gt; privilege escalation.</p> <p>STEPS TO REPRODUCE 1. As a user with &#34;customfields.create&#34;, create a Custom Field named: `&lt;img src=x onerror=alert(1)&gt;` 2. Add the field to a fieldset that is associated with an asset model. 3. Open `/hardware` -&gt; the payload executes on load.</p> <p>DEMONSTRATED IMPACT An account holding ONLY &#34;customfields.create&#34; (HTTP 403 on /users) planted a payload that, when a superuser opened /hardware, issued an authenticated request in that session and granted the attacker&#39;s own account the &#34;superuser&#34; permission (afterwards: GET /users = 200, isSuperUser() = true).</p> <p>ROOT CAUSE - Blade {{ }} encodes the data-columns attribute, but the browser decodes it back before bootstrap-table reads the title; bootstrap-table then renders the header title unescaped because its table-level &#34;escape&#34; option defaults to false and is never enabled. (The per-column &#39;escape&#39; =&gt; true covers cell values, not the header tit…</p> <p><strong>Affected:</strong> Packagist: snipe/snipe-it</p> <p>### Impact A user with the &#34;customfields.create&#34; permission can store HTML/JS in a Custom Field name, which is later rendered as an asset-list column title WITHOUT escaping at app/Presenters/AssetPresenter.php line 364 (&#39;title&#39; =&gt; $field-&gt;name) and injected into the table header by the bundled bootstrap-table plugin. It executes for anyone who opens an asset list (e.g. /hardware), including superusers, on page load with no interaction. Since &#34;customfields.create&#34; can be granted to non-superusers, a lower-privileged user gets script execution in a superuser&#39;s session -&gt; privilege escalation.</p> <p>STEPS TO REPRODUCE 1. As a user with &#34;customfields.create&#34;, create a Custom Field named: `&lt;img src=x onerror=alert(1)&gt;` 2. Add the field to a fieldset that is associated with an asset model. 3. Open `/hardware` -&gt; the payload executes on load.</p> <p>DEMONSTRATED IMPACT An account holding ONLY &#34;customfields.create&#34; (HTTP 403 on /users) planted a payload that, when a superuser opened /hardware, issued an authenticated request in that session and granted the attacker&#39;s own account the &#34;superuser&#34; permission (afterwards: GET /users = 200, isSuperUser() = true).</p> <p>ROOT CAUSE - Blade {{ }} encodes the data-columns attribute, but the browser decodes it back before bootstrap-table reads the title; bootstrap-table then renders the header title unescaped because its table-level &#34;escape&#34; option defaults to false and is never enabled. (The per-column &#39;escape&#39; =&gt; true covers cell values, not the header tit…</p> https://db.gcve.eu/vuln/ghsa-p9h3-gvpq-5539