HIGHCVE-2026-25932Published Modified CNA GitHub_M
CVE-2026-25932: GLPI has Stored XSS in Supplier 'Website' field
GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier fields. This vulnerability is fixed in 10.0.24.
Metrics
- CVSS v3.1
- 7.2
- Severity
- HIGH
- Fixed in
- —
- Affected Products
- 1
Affected packages
- glpi-project / glpi>= 0.60, < 10.0.24
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H