{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"8.3.4"}],"component":"snipe/snipe-it","cve_ids":["CVE-2025-64027"],"ecosystem":"Packagist","epss":0.00253,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-8x9v-8qgj-945x","id":"tcs_01M5KEZFGCPGPQWGYZAKXSVAYM","modified_at":"2025-11-21T19:10:20.164647Z","published_at":"2025-11-20T18:31:01Z","references":["https://osv.dev/vulnerability/GHSA-8x9v-8qgj-945x","https://nvd.nist.gov/vuln/detail/CVE-2025-64027","https://github.com/cybercrewinc/CVE-2025-64027","https://github.com/grokability/snipe-it"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-8x9v-8qgj-945x","url":"https://osv.dev/vulnerability/GHSA-8x9v-8qgj-945x"},{"source":"nvd","source_id":"CVE-2025-64027","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64027"}],"summary":"Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow"}