Unrated severityNVD Advisory· Published Nov 3, 2022· Updated Apr 23, 2025
Cross-Site Scripting (XSS) through public RSS feed in GLPI
CVE-2022-39375
Description
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to create a public RSS feed to inject malicious code in dashboards of other users. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds.
Affected products
1- Range: >= 0.84, < 10.0.4
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.