CVE-2026-55214

Published: Set 25, 2026 Last Modified: Set 25, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.

116

Improper Encoding or Escaping of Output

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability Access Control
Potential Impacts:
Modify Application Data Execute Unauthorized Code Or Commands Bypass Protection Mechanism
Applicable Platforms
Technologies: Not Technology-Specific, AI/ML, Database Server, Web Server
Likelihood of Exploit: High
View CWE Details
https://github.com/glpi-project/glpi/commit/970786ed3b817c4…
https://github.com/glpi-project/glpi/commit/970786ed3b817c4c2bf90b8457b024ec566…
https://github.com/glpi-project/glpi/releases/tag/11.0.8
https://github.com/glpi-project/glpi/releases/tag/11.0.8
https://github.com/glpi-project/glpi/security/advisories/GH…
https://github.com/glpi-project/glpi/security/advisories/GHSA-8v8p-w8mq-wqcg