6.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-59712

CVE-2025-59712: Snipe-IT allows XSS

Snipe-IT before 8.1.18 allows XSS.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-59712

CVE-2025-59712:

6.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
snipe/snipe-it	composer	< 8.1.18	8.1.18

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis began by examining the release notes for Snipe-IT version 8.1.18, the patched version. The release notes explicitly mentioned a fix for escaping user_agent and remote_ip variables in API results, referencing pull request #17330. By inspecting this pull request and its associated commit, I identified the exact code change that addressed the vulnerability. The commit diff clearly shows that the e() (escape) function was added to the remote_ip and user_agent fields within the transformActionlog method of the ActionlogsTransformer.php file. This indicates that prior to the patch, these values were being returned unescaped, creating a Cross-Site Scripting (XSS) vulnerability. When action logs were retrieved via the API, any malicious scripts stored in the user_agent or remote_ip fields would be rendered, leading to execution in the client's browser. Therefore, the transformActionlog function is the identified vulnerable function as it was responsible for processing and returning the unescaped, potentially malicious data.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.