CVE-2025-59935 MEDIUM

CVE-2025-59935: GLPI Vulnerable to Unauthenticated Stored XSS on the Inventory page

Vendor Glpi-Project
Product glpi
Weakness CWE-79 · XSS
Published December 16, 2025
Last update December 16, 2025
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.21, an unauthenticated user can store an XSS payload through the inventory endpoint. Users should upgrade to 10.0.21 to receive a patch.

Key dates

02Disclosure timeline

December 16, 2025 CVE published
December 16, 2025 Record updated