CVE-2025-59935

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.21, an unauthenticated user can store an XSS payload through the inventory endpoint. Users should upgrade to 10.0.21 to receive a patch.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/glpi-project/glpi/security/advisories/GHSA-j8vv-9f8m-r7jx	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*

History

13 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) GLPI es un paquete de software gratuito de gestión de activos y TI. A partir de la versión 10.0.0 y antes de la versión 10.0.21, un usuario no autenticado puede almacenar una carga útil de XSS a través del endpoint de inventario. Los usuarios deben actualizar a la versión 10.0.21 para recibir un parche.

Information

Published : 2025-12-16 17:16

Updated : 2026-10-13 11:10

NVD link : CVE-2025-59935

Mitre link : CVE-2025-59935

CVE.ORG link : CVE-2025-59935

JSON object : View

Products Affected

glpi-project

glpi

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-59935", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59935", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-16T17:15:15.316595Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "glpi-project", "product": "glpi", "versions": [{"status": "affected", "version": ">= 10.0.0, < 10.0.21"}]}]}], "published": "2025-12-16T17:16:10.137", "references": [{"url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-j8vv-9f8m-r7jx", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.21, an unauthenticated user can store an XSS payload through the inventory endpoint. Users should upgrade to 10.0.21 to receive a patch."}, {"lang": "es", "value": "GLPI es un paquete de software gratuito de gesti\u00f3n de activos y TI. A partir de la versi\u00f3n 10.0.0 y antes de la versi\u00f3n 10.0.21, un usuario no autenticado puede almacenar una carga \u00fatil de XSS a trav\u00e9s del endpoint de inventario. Los usuarios deben actualizar a la versi\u00f3n 10.0.21 para recibir un parche."}], "lastModified": "2026-10-13T11:10:00.203", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71497A1A-8C87-48D5-9BA2-CFFF057BC3A7", "versionEndExcluding": "10.0.21", "versionStartIncluding": "10.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}