CVE-2025-52897
GLPI is vulnerable to XSS and open redirection attacks through planning feature
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
GLPI is vulnerable to XSS and open redirection attacks through planning feature
GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19.
Reserved 2025-06-20 | Published 2025-07-30 | Updated 2025-07-30 | Assigner GitHub_MCWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
github.com/...t/glpi/security/advisories/GHSA-6whm-q2rp-prqm
Support options
