CyberRota Analysis
AI-GeneratedGLPI versions 11.0.6 to 11.0.8 are vulnerable to stored cross-site scripting (XSS) attacks, where an authenticated technician can inject malicious scripts into supplier website fields. When other users access the suppliers list, the payload executes, potentially compromising user data and session integrity. Organizations using affected versions should prioritize upgrading to 11.0.8 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.