CVE-2025-59935 — Cross-site Scripting in Glpi

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 69.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Glpi-project Glpi
Timeline
PublishedDec 16

Description

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.21, an unauthenticated user can store an XSS payload through the inventory endpoint. Users should upgrade to 10.0.21 to receive a patch.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDglpi-project/glpi10.0.0 — 10.0.21
▶CVEListV5glpi-project/glpi>= 10.0.0, < 10.0.21

🔴Vulnerability Details

1
OSV
CVE-2025-59935: GLPI is a free asset and IT management software package↗2025-12-16
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-59935 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶