This vulnerability allows an unauthenticated user to inject a malicious script into a GLPI instance through the inventory endpoint. The stored payload is saved and later rendered in the browser of any user who views the affected page, permitting the attacker to steal session cookies, deface content, or execute arbitrary actions in the context of the victim. The weakness arises because the application fails to encode or filter the data before storage, matching the CWE‑79 classification.

GLPI, the open‑source asset and IT management application from the glpi‑project. Versions from 11.0.0 up to, but not including, 11.0.6 are affected. All installations that expose the inventory interface without requiring authentication are at risk.

The CVSS score of 7.5 indicates a high severity. With an EPSS score below 1 % the probability of public exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. However, the flaw can be exercised trivially by anyone who can access the GLPI web interface and does not need privileged credentials. Attackers simply need to submit a crafted payload to the inventory form and then lure another user to view the stored data.