Reflected XSS Vulnerability in GLPI IT Management Software

CVE-2025-21627

What is CVE-2025-21627?

GLPI, a popular free asset and IT management software, is susceptible to a reflected XSS vulnerability in versions prior to 10.0.18. This security issue arises from the search page, where an attacker can craft a malicious link to exploit the vulnerability, especially if anonymous ticket creation is enabled. As a result, an unauthenticated user can potentially execute malicious scripts, compromising the security of the application and its users. The vulnerability has been addressed in version 10.0.18, which includes a fix to mitigate this risk.

References