XSS in Glpi-Project Glpi
CVE-2026-5385
An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item. This issue affects glpi: before 11.0.7.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
EPSS exploit prediction
EPSS: 0.006 (45.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 45.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.006 · change: +0.002
Affected products
- Glpi-Project Glpi — versions 0
Weakness classification (CWE)
References
- fluidattacks.com/es/advisories/bizkit (third-party-advisory)
- github.com/glpi-project/glpi (product)
- github.com/glpi-project/glpi/security/advisories/GHSA-2fg5-jg72-h338 (vendor-advisory)
- github.com/glpi-project/glpi/releases/tag/11.0.7 (patch)