Threat Investigation
Request a demo

CVE-2025-21627

Medium

Description

GLPI is a free asset and IT management software package. In versions prior to 10.0.18, a malicious link can be crafted to perform a reflected XSS attack on the search page. If the anonymous ticket creation is enabled, this attack can be performed by an unauthenticated user. Version 10.0.18 contains a fix for the issue.

SeverityMedium
CVSS6.5
Exploit probability—
ProductGlpi
PublishedFeb 25, 2025
First seenFeb 25, 2025
Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update
  • glpi-project glpi10.0.18 or later

Affected products

ProductAffected versionsFixed in
glpi-project glpiv < 10.0.1810.0.18

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.