Tag

Cve-2026-63498

1 brief RSS

Stored XSS in Snipe-IT Uploaded Files API

Snipe-IT contains a stored XSS vulnerability in the uploaded-files API due to the failure to apply safe-inline allowlists to XML documents, allowing authenticated attackers to execute arbitrary JavaScript in the victim's session context via CVE-2026-63498.

Snipe-IT web-application xss cve-2026-63498 web-vulnerability privilege-escalation

1r 6t 1c 46m ago