PT-2026-45959 · Glpi · Glpi

Yavolo · CVE-2026-42321 · Published 2026-06-03 · Updated 2026-06-03

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions GLPI versions 10.0.4 through 10.0.24

Description A technician can store a Cross-Site Scripting (XSS) payload in the asset locked tab. XSS is a type of security flaw that allows an attacker to inject malicious scripts into web pages viewed by other users.

Recommendations Update to version 10.0.25 or 11.0.7.

Exploit

Fix

XSS

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-79

CWE-116

Related Identifiers

CVE-2026-42321

GHSA-HWJC-8228-55X4

Affected Products

Glpi

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42321.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42321 · Security Note
• https://ubuntu.com/security/CVE-2026-42321 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42321 · Security Note
• https://osv.dev/vulnerability/CVE-2026-42321 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42321 · Vendor Advisory
• https://github.com/glpi-project/glpi/security/advisories/GHSA-hwjc-8228-55x4 · Note