CVE-2025-59935CWE-79cross-site-scripting
CVE-2025-59935
Medium · published December 16, 2025
What it is
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.21, an unauthenticated user can store an XSS payload through the inventory endpoint. Users should upgrade to 10.0.21 to receive a patch.
The record
Technical detail
- CVSS v3.1
- 6.5 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00288 · 20.2th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2025-12-16T22:16Z
Affected products (1)
| Product | Versions | Fixed in |
|---|
| glpi-project/glpi | ≥ 10.0.0, < 10.0.21 | 10.0.21 |
References (1)
EPSS history
Timeline