CVE-2025-26626

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-26626

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-26626.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-26626

Aliases

GHSA-8p38-r7vf-j6jx

Published

2025-03-14T12:47:14.011Z

Modified

2026-07-15T01:49:07.338485067Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

GLPI Inventory Plugin vulnerable to reflective Cross-site Scripting

Details

The GLPI Inventory Plugin handles various types of tasks for GLPI agents for the GLPI asset and IT management software package. Versions prior to 1.5.0 are vulnerable to reflective cross-site scripting, which may lead to executing javascript code. Version 1.5.0 fixes the issue.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26626.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/glpi-project/glpi-inventory-plugin

Affected ranges

Type

GIT

Repo

https://github.com/glpi-project/glpi-inventory-plugin

Events

Introduced

Fixed

100292d0f7d48a0befe5ba04177c0804fe173b61

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.5.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.1.0

1.2.0

1.2.1

1.2.2

1.2.3

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-26626.json"