CVE-2026-42321 — GLPI has stored XSS in asset locks
GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a technician can store an XSS payload in the asset locked tab. …
Published: 2026-06-03 · CVSS: 8.4 · CVSS 4.0
GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a technician can store an XSS payload in the asset locked tab. Upgrade to 10.0.25 or 11.0.7 to receive a patch.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7