GLPI is a free asset and IT management software. Versions from 0.60 up to, but not including, 10.0.24 allow an authenticated technician to store malicious scripts in the supplier "Website" field. When that field is viewed, the stored payload is rendered, granting the attacker the ability to deface pages, hijack sessions, or exfiltrate data. This constitutes a CWE-79 vulnerability and involves encoding issues (CWE-116).

GLPI Project GLPI, any version earlier than 10.0.24. The vulnerability can be exploited by users with technician‑level edit permissions on supplier records.

The CVSS score is 7.2, reflecting a high severity. The EPSS score is below 1% and the issue is not listed in KEV, indicating limited known exploitation. However, because the exploit only requires local authenticated access, it is relatively easy for any technician with edit rights to inject a payload, potentially impacting many users who view the supplier information.