CVE-2025-63743

Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated attacker with lowest privileges sufficient only to log in, to inject arbitrary JavaScript code via "Name" and "Surname" fields. The JavaScript code is executed whenever "Activity Report" or modified profile is viewed directly by any user with sufficient permissions. Successful exploitation of this issue requires that the profile's "Display Name" is not set. The vulnerability is fixed in v8.3.2.

• CWE-79

• https://github.com/grokability/snipe-it/commit/b6d397bcca4e8a05176b782de769d7160058bfc4#diff-7fe056d76c09808dac923c4639161d587c3fff281a01122f3e10c4a781674a65
• https://github.com/mikust/CVEs/tree/main/CVE-2025-63743

Published

Apr 13, 2026

Last Modified

Jul 5, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-63737Cross-site scripting (XSS) vulnerability in function urltest…6.1
• CVE-2025-63738An issue was discovered in file index.php in Xinhu Rainrock …4.3
• CVE-2025-63739An issue was discovered in function phpinisaveAction in file…4.3
• CVE-2025-6374A vulnerability was found in D-Link DIR-619L 2.06B01 and cla…8.8
• CVE-2025-63740SQL Injection vulnerability in function getselectdataAjax in…4.3
• CVE-2025-63742SQL Injection vulnerability in function setwxqyAction in fil…9.8
• CVE-2025-63744A NULL pointer dereference vulnerability was discovered in r…4.3
• CVE-2025-63745A NULL pointer dereference vulnerability was discovered in r…5.5
• CVE-2025-63747QaTraq 6.9.2 ships with administrative account credentials w…9.8
• CVE-2025-63748QaTraq 6.9.2 allows authenticated users to upload arbitrary …8.8
• CVE-2025-63749pnetlab 5.3.11 is vulnerable to Command Injection via the qe…6.5
• CVE-2025-6375A vulnerability was found in poco up to 1.14.1. It has been …5.5