OCTOBER 9, 2026
Live Feed
Back to database
Case File

CVE-2026-53610

HIGH · CVSS 7.5 EPSS 0.39% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-25 · Last synced 2026-10-09

CyberRota Analysis

AI-Generated

GLPI versions 11.0.0 to 11.0.8 are vulnerable to reflected cross-site scripting (XSS) due to insufficient output encoding in dashboard URLs, allowing attackers to inject malicious markup. This vulnerability poses a high risk as it can lead to unauthorized actions or data exposure for users accessing the compromised dashboard. Organizations using affected versions should prioritize upgrading to version 11.0.8 to mitigate this security risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-53610
Severity
HIGH
CVSS
7.5
EPSS
0.39%

Original NVD Description

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. This issue is fixed in version 11.0.8.