CVE-2025-21627

CVSS 3.1 Score 6.1 of 10 (medium)

Details

Published Feb 25, 2025
Updated: Mar 4, 2025
CWE ID 79

Summary

CVE-2025-21627 is a vulnerability affecting GLPI, a free IT management software. Before version 10.0.18, the search page could be exploited through a maliciously crafted link, leading to a reflected Cross-Site Scripting (XSS) attack. An unauthenticated user could execute this attack if anonymous ticket creation is enabled. Version 10.0.18 includes a patch to resolve this issue.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • GLPI Project
  • Glpi-project GLPI

Affected Vendors

  • Teclib
  • Glpi-project

Advisories, Assessments, and Mitigations