Unrated severityNVD Advisory· Published Jul 29, 2025· Updated Jul 29, 2025
GLPI is susceptible to Stored XSS attack through project's kanban
CVE-2025-27514
Description
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 9.5.0 through 10.0.18, a technician can use a malicious payload to trigger a stored XSS on the project's kanban. This is fixed in version 10.0.19.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2>=9.5.0, <=10.0.18+ 1 more
- (no CPE)range: >=9.5.0, <=10.0.18
- (no CPE)range: >= 9.5.0, < 10.0.19
Patches
Vulnerability mechanics
References
2- github.com/glpi-project/glpi/commit/c340a64a11343bde706d1cd41e4be798dd922303mitrex_refsource_MISC
- github.com/glpi-project/glpi/security/advisories/GHSA-jh8j-gqxc-6gqjmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.