Authenticated users with the lowest privilege level can insert arbitrary JavaScript into the Name and Surname fields of user profiles in Snipe‑IT v8.3.0–8.3.1 when the profile’s Display Name field is left blank. When another user views the Activity Report or the modified profile, the injected code runs in that user’s browser session. The description implies this could allow client‑side attacks such as credential theft or phishing, but these specific outcomes are inferred from typical XSS effects.

Affected software is the Snipe‑IT web‑based asset‑management system, version 8.3.0 through 8.3.1 inclusive. The fix is available in version 8.3.2 and later. No other vendors or product variants are listed in the CNA data.

The CVSS score of 5.4 represents medium severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not present in the CISA KEV catalog. Exploitation requires an authenticated session and a target profile lacking a Display Name; the attacker must also have permission to view the Activity Report or the modified profile for the malicious script to execute. Because the vulnerability is reachable via the web interface and affects authenticated users, the risk is partly mitigated by user‑level controls but remains for environments where the low‑privilege accounts can edit profiles and view reports.