← All advisories

Medium severity6.1NVD Advisory· Published Jul 4, 2019· Updated Jun 17, 2026

CVE-2019-13239

CVE-2019-13239

Description

inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3

Glpi Project/Glpi2 versions
cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*range: >=9.1,<9.4.3
- (no CPE)range: <9.4.3
GLPI/GLPIdescription

Patches

Vulnerability mechanics

References

3

github.com/glpi-project/glpi/commit/c2aa7a7cd6af28be3809acc7e7842d2d2008c0fbnvdPatchThird Party Advisory
www.synacktiv.com/ressources/advisories/GLPI_9.4.0_stored_XSS.pdfnvdExploitThird Party Advisory
github.com/glpi-project/glpi/releases/tag/9.4.3nvdRelease NotesThird Party Advisory

News mentions

0

No linked articles in our index yet.