CVE-2025-65622 is a stored XSS vulnerability in Snipe-IT before version 8.3.4. The issue arises from insufficient input sanitization of the 'Country' field within the Locations feature. An attacker with low-level authenticated access can inject JavaScript payloads that execute when other users view the affected data, potentially leading to session hijacking or other client-side impacts. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Successful exploitation allows a low-privileged authenticated user to execute arbitrary JavaScript in the browsers of other users, which can lead to session hijacking, unauthorized actions performed on behalf of the victim, or theft of sensitive information accessible in the victim's session. There is no indication of direct impact on system availability or integrity beyond the client-side script execution.

Upgrade Snipe-IT to version 8.3.4 or later, where this vulnerability has been fixed. Since no official patch links are provided, verify with the vendor or official Snipe-IT release notes to confirm the availability of the fix. Until the upgrade is applied, restrict access to trusted users and avoid entering untrusted data into the 'Country' field. Patch status is not yet confirmed by vendor advisory; check official sources for current remediation guidance.