Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a selector, concatenates countId.substring(1) into an HTML string, and passes the string to jQuery .after(). A crafted name can therefore execute JavaScript when an authenticated user views the manufacturer detail page or supplier detail page, potentially exposing data or actions available to that session. This issue is fixed in version 8.6.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🟠 Snipe-IT, Stored DOM-Based Cross-Site Scripting (XSS), #CVE-2026-61807 (Medium) -DC-Aug2026-1675 https://dailycve.com/snipe-it-stored-dom-based-cross-site-scripting-xss-cve-2026-61807-medium-dc-aug2026-1675/
Post summary
CVE-2026-61807 is a Medium‑severity Stored DOM‑Based Cross‑Site Scripting vulnerability affecting Snipe‑IT.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | snipeitapp | snipe-it | - | - | - |