What’s Vulnerable › Vulnerabilities

CVE-2023-22724: glpi contains XSS in RSS Description Link

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-01-26 · updated 2026-06-17
• Weakness: CWE-79

Description

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting (XSS) payloads inside RSS links. Victims who wish to visit an RSS content and click on the link will execute the Javascript. This issue is patched in 10.0.6.

Affected products

• glpi-project glpi: from 10.0.0 before 10.0.6 — fixed in 10.0.6

How to fix

Upgrade to a fixed version: glpi-project glpi 10.0.6. Check the vendor advisory for mitigations.

References

• https://github.com/glpi-project/glpi/security/advisories/GHSA-x9g4-j85w-cmff
• https://github.com/glpi-project/glpi/security/advisories/GHSA-x9g4-j85w-cmff

Get alerted when CVE-2023-22724 or the next vulnerability affects your stack