VYPR
← All advisories
Unrated severityNVD Advisory· Published Apr 5, 2023· Updated Feb 13, 2025

GLPI vulnerable to reflected Cross-site Scripting in search pages

CVE-2023-28639

Description

GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is fixed in versions 9.5.13 and 10.0.7.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Glpi Project/Glpillm-fuzzy2 versions
    >= 0.85, < 9.5.13 || >= 9.5.13, < 10.0.7 || >= 10.0.7+ 1 more
    • (no CPE)range: >= 0.85, < 9.5.13 || >= 9.5.13, < 10.0.7 || >= 10.0.7
    • (no CPE)range: 0.85

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.