CVE-2025-63743 is a Cross-Site Scripting vulnerability affecting Snipe-IT asset management system versions 8.3.0 and 8.3.1. An attacker with only login privileges can inject JavaScript through the "Name" and "Surname" fields. The malicious script executes when privileged users view the "Activity Report" or the affected profile, contingent on the "Display Name" field being unset. This issue allows limited impact on confidentiality and integrity but does not affect availability. The vulnerability is resolved in version 8.3.2.

Successful exploitation allows an authenticated low-privilege user to execute arbitrary JavaScript in the context of users with higher permissions when viewing certain reports or profiles. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed by privileged users. There is no impact on availability. No known exploits in the wild have been reported.

Upgrade Snipe-IT to version 8.3.2 or later, where this vulnerability is fixed. Until the upgrade is applied, restrict access to the affected fields and monitor user inputs if possible. No official patch link was provided, but the vendor's release notes for version 8.3.2 should be consulted for the fix.