| Package | Affected versions | Patched versions |
|---|---|---|
| snipe-it | = 7.0.13 |
An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be executed, allowing the attacker to exfiltrate internal system data from the CSV file to a remote server.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free