CPE
high
advisory
Arbitrary Command Execution in Snipe-IT Backup Restoration
1 rule 14 TTPs 1 CVESnipe-IT versions prior to 8.7.0 are vulnerable to OS command injection when a superadministrator restores a crafted backup archive, allowing arbitrary command execution via the MySQL client.
Snipe-IT +1
remote-code-execution
cve
vulnerability
web-vulnerability
css-injection
account-takeover
cve-2026-86751
ssrf
+8
1r
14t
1c
updated
high
advisory
Broken Access Control in Snipe-IT Asset Maintenance API
2 rules 2 TTPs 1 CVEAn authenticated user in a multi-company Snipe-IT deployment can exploit an authorization flaw in the asset maintenance update API to re-parent records to assets owned by other companies, breaking tenant isolation.
Snipe-IT +2
web-application
privilege-escalation
multi-tenant
web-application-vulnerability
path-traversal
cve-2026-55474
authorization-bypass
asset-management
2r
2t
1c