GLPI versions 11.0.0 through 11.0.5 contain an unauthenticated stored cross‑site scripting vulnerability that allows a user without authentication to store malicious scripts via the inventory endpoint. The stored payload is rendered later when a user views inventory data, potentially executing arbitrary JavaScript in that user’s browser. Based on the description, it is inferred that any authenticated user who views the affected inventory item would be subject to the script execution, leading to client‑side code execution and possible session hijacking or data theft. This flaw is a typical input validation failure and is classified as CWE-79.

The vulnerability affects the glpi project’s GLPI asset and IT management software. All releases from version 11.0.0 up to, but not including, 11.0.6 are impacted. Version 11.0.6 and later contain the vendor‑supplied fix.

The CVSS base score of 7.5 indicates high severity. The attack requires no credentials and exploits a publicly reachable endpoint, meaning the effort to attack is low. No publicly documented exploits are listed in the provided data, and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog. The EPSS score is not available, preventing a precise approximation of exploitation frequency, but the combination of high severity and low effort still presents a significant risk.