CVE-2022-1380

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
snipe	snipe/snipe-it	>= unspecified, < v5.4.3

References

https://github.com/snipe/snipe-it/commit/f211c11034baf4281aa62e7b5e0347248d995ee9Patch, Third Party Advisory
https://huntr.dev/bounties/3d45cfca-3a72-4578-b735-98837b998a12Exploit, Patch, Third Party Advisory
https://github.com/snipe/snipe-it/commit/f211c11034baf4281aa62e7b5e0347248d995ee9Patch, Third Party Advisory
https://huntr.dev/bounties/3d45cfca-3a72-4578-b735-98837b998a12Exploit, Patch, Third Party Advisory

Timeline

Published: Apr 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-13817.8global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software CVE-2022-13825.5NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of making the radare2 crash, t CVE-2022-13836.1Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8. The bug causes the program reads data past the end of the CVE-2022-13848.8Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allow CVE-2022-13854.6Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, wh CVE-2022-13869.8The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to CVE-2022-13874.8The No Future Posts WordPress plugin through 1.4 does not escape its settings, which could allow high privilege users such as admin to perfo CVE-2022-13889.8On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior CVE-2022-13894.3On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0), a cross-site request forgery (CSRF) vu CVE-2022-13909.8The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthe CVE-2022-13919.8The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, whic CVE-2022-13927.5The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could le