CVE-2026-25932 — GLPI has Stored XSS in Supplier 'Website' field

CVE-2026-25932

GLPI has Stored XSS in Supplier 'Website' field PUBLISHED

Description (CNA)

GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier fields. This vulnerability is fixed in 10.0.24.

Affected (CNA)

Vendor / product	Versions
glpi-project / glpi	affected >= 0.60, < 10.0.24

CWE

CWE-116, CWE-79

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-m627-945g-x7xh

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.