CVE-2026-5385CWE-79
GLPI 11.0.0 - Stored XSS in knowledge base
High · published June 2, 2026
What it is
An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item.
This issue affects glpi: before 11.0.7.
The record
Technical detail
- CVSS v4.0
- 8.4 · HIGH
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS
- 0.00571 · 46.5th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2026-06-02T18:32Z
EPSS history
Timeline