An authenticated technician can embed active markup into supplier website fields, allowing a stored cross‑site scripting attack that may steal session cookies, deface pages, or redirect users. The vulnerability is defined by CWE-116, indicating input is stored without proper escaping, leading to code execution on consumers’ browsers.

GLPI asset management software from version 11.0.6 up to and including 11.0.8 is affected. The flaw resides in the supplier website field handling in these releases of GLPI.

With a CVSS score of 8.5 the flaw is considered high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a technician role to store the payload, and any user who opens the affected supplier list will trigger the script. The stored nature of the payload means it persists across sessions, making the threat persistent.