CVE-2026-42321CWE-116CWE-79

GLPI has stored XSS in asset locks

High · published June 3, 2026

CVSS v4.0
8.4
EPSS
0%
Percentile
35.0
In the wild
Unconfirmed
What it is

GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a technician can store an XSS payload in the asset locked tab. Upgrade to 10.0.25 or 11.0.7 to receive a patch.

The record
Technical detail
CVSS v4.0
8.4 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00418 · 35.0th percentile
Weaknesses
CWE-116 · Improper Encoding or Escaping of Output; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-06-03T15:25Z
EPSS history
Timeline
  • 03 JUN 15:25Z
    GLPI has stored XSS in asset locks
    cvelistv5