GLPI, an open‑source asset and IT management platform, has a reflected cross‑site scripting vulnerability in its dashboard pages. From version 11.0.0 through 11.0.8, a crafted URL can embed arbitrary markup that is rendered without proper encoding. When a user opens the URL, the malicious script executes within the victim’s browser, potentially allowing attackers to steal credentials, deface the interface, or perform further actions under the user’s session. This weakness is classified under CWE‑79, indicating a lack of output sanitization for user‑controlled data.

The affected product is GLPI from the glpi‑project organization, versions 11.0.0 up to and including 11.0.8. All installations of GLPI within that version range that expose dashboard URLs are vulnerable; precise vendor and product names are supplied by the CNA.

The CVSS score of 7.5 marks this flaw as high severity, and the EPSS score is not available, so current exploitation likelihood is uncertain. It is not listed in the CISA KEV catalog, suggesting no confirmed exploits in the wild yet. Attackers can materialize the vulnerability by sending a malicious link to a potential victim, who may unknowingly visit it. Without account or system compromise, the attacker’s impact is limited to the victim’s browser session, but an active user session could be hijacked or sensitive data exposed.