glpi-project -- GLPI multiple vulnerabilitiesentered 2025-05-29
no CVE referenced
CVE details
CVE-2025-21627
GLPI is a free asset and IT management software package. In versions prior to 10.0.18, a malicious link can be crafted to perform a reflected XSS attack on the search page. If the anonymous ticket creation is enabled, this attack can be performed by an unauthenticated user. Version 10.0.18 contains a fix for the issue.
- Score
- 6.5 medium
- Published
- 2025-02-25
- Links
- NVD · cve.org · Report wrong data
Matched ports (0)
No port is within the affected range.