CVE-2025-27514CWE-79CWE-80

GLPI is susceptible to Stored XSS attack through project's kanban

Medium · published July 29, 2025

CVSS v3.1
4.5
EPSS
0%
Percentile
9.7
In the wild
Unconfirmed
What it is

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 9.5.0 through 10.0.18, a technician can use a malicious payload to trigger a stored XSS on the project's kanban. This is fixed in version 10.0.19.

The record
Technical detail
CVSS v3.1
4.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00203 · 9.7th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2025-07-29T17:39Z
EPSS history
Timeline
  • 29 JUL 17:39Z
    GLPI is susceptible to Stored XSS attack through project's kanban
    cvelistv5