CVE-2018-7563

An issue was discovered in GLPI through 9.2.1. The application is affected by XSS in the query string to front/preference.php. An attacker is able to create a malicious URL that, if opened by an authenticated user with debug privilege, will execute JavaScript code supplied by the attacker. The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

• CWE-79

• https://github.com/glpi-project/glpi/pull/3647Issue Tracking, Third Party Advisory
• https://membership.backbox.org/glpi-9-2-1-multiple-vulnerabilities/Permissions Required
• https://github.com/glpi-project/glpi/pull/3647Issue Tracking, Third Party Advisory
• https://membership.backbox.org/glpi-9-2-1-multiple-vulnerabilities/Permissions Required

Published

Mar 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7556LimeSurvey 2.6.x before 2.6.7, 2.7x.x before 2.73.1, and 3.x…
• CVE-2018-7557The decode_init function in libavcodec/utvideodec.c in FFmpe…6.5
• CVE-2018-7559An issue was discovered in OPC UA .NET Standard Stack and Sa…
• CVE-2018-7560index.js in the Anton Myshenin aws-lambda-multipart-parser N…7.5
• CVE-2018-7561Stack-based Buffer Overflow in httpd on Tenda AC9 devices V1…
• CVE-2018-7562A remote code execution issue was discovered in GLPI through…
• CVE-2018-7564Stored XSS exists on Polycom QDX 6000 devices.
• CVE-2018-7565CSRF exists on Polycom QDX 6000 devices.
• CVE-2018-7566The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ…
• CVE-2018-7567In the Admin Package Manager in Open Ticket Request System (…
• CVE-2018-7568The parse_die function in dwarf1.c in the Binary File Descri…
• CVE-2018-7569dwarf2.c in the Binary File Descriptor (BFD) library (aka li…