EUVD-2026-19247Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionGitHub Advisory
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6.
AnalysisAI
Stored XSS in GLPI 11.0.0-11.0.5 allows remote attackers to inject malicious scripts via the inventory endpoint without authentication, leading to potential session hijacking and unauthorized actions when victims interact with poisoned inventory data. CVSS 7.5 (High) with Network attack vector and no privileges required (PR:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | GLPI versions 11.0.0 through 11.0.5. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.5 High severity reflects the unauthenticated attack surface (AV:N/PR:N) enabling external threat actors to inject persistent malicious payloads, though High attack complexity (AC:H) and required user interaction (UI:R) provide some friction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An external attacker identifies an internet-accessible GLPI 11.0.4 instance used by an organization for IT asset tracking. Without authentication, the attacker crafts a malicious HTTP request to the inventory endpoint containing a JavaScript payload disguised as legitimate asset metadata (e.g., in computer name or serial number fields). … |
| Remediation | Immediately upgrade to GLPI version 11.0.6 or later, which contains the vendor-released patch addressing the inventory endpoint input validation flaw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all GLPI 11.0.x instances in your environment and document their network accessibility status. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today