Unrated severityNVD Advisory· Published Jul 29, 2025· Updated Jul 29, 2025
GLPI is susceptible to Stored XSS attack through project's kanban
CVE-2025-27514
Description
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 9.5.0 through 10.0.18, a technician can use a malicious payload to trigger a stored XSS on the project's kanban. This is fixed in version 10.0.19.
Affected products
1- Range: >= 9.5.0, < 10.0.19
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- github.com/glpi-project/glpi/commit/c340a64a11343bde706d1cd41e4be798dd922303mitrex_refsource_MISC
- github.com/glpi-project/glpi/security/advisories/GHSA-jh8j-gqxc-6gqjmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.