Is CVE-2025-63743 actively exploited?

No active exploitation of CVE-2025-63743 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-63743 be exploited remotely?

Yes. CVE-2025-63743 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-63743?

CVE-2025-63743 has a CVSS score of 5.4 (MEDIUM).

HOME VULNERABILITIESCVE-2025-63743

MEDIUM

CVE-2025-63743

Published: April 13, 2026· Updated: Apr 17, 2026

5.4

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:6.1th

Official Description

Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated attacker with lowest privileges sufficient only to log in, to inject arbitrary JavaScript code via "Name" and "Surname" fields. The JavaScript code is executed whenever "Activity Report" or modified profile is viewed directly by any user with sufficient permissions. Successful exploitation of this issue requires that the profile's "Display Name" is not set. The vulnerability is fixed in v8.3.2.

NVD Source

Technical Analysis

CVE-2025-63743 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.