CVE-2020-11036

In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content "<script>alert(1)</script>" reproduces the attack. This can be exploited by a user with administrator privileges in the User-Agent field. It can also be exploited by an outside party through the following steps: 1. Create a user with the surname `" onmouseover="alert(document.cookie)` and an empty first name. 2. With this user, create a ticket 3. As an administrator (or other privileged user) open the created ticket 4. On the "last update" field, put your mouse on the name of the user 5. The XSS fires This is fixed in version 9.4.6.

• CWE-79
• CWE-79

• https://github.com/glpi-project/glpi/security/advisories/GHSA-3g3h-rwhr-7385Exploit, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/
• https://github.com/glpi-project/glpi/security/advisories/GHSA-3g3h-rwhr-7385Exploit, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/

Published

May 5, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11030In affected versions of WordPress, a special payload can be …5.4
• CVE-2020-11031In GLPI before version 9.5.0, the encryption algorithm used …7.5
• CVE-2020-11032In GLPI before version 9.4.6, there is a SQL injection vulne…7.2
• CVE-2020-11033In GLPI from version 9.1 and before version 9.4.6, any API u…7.2
• CVE-2020-11034In GLPI before version 9.4.6, there is a vulnerability that …6.1
• CVE-2020-11035In GLPI after version 0.83.3 and before version 9.4.6, the C…9.3
• CVE-2020-11037In Wagtail before versions 2.7.3 and 2.8.2, a potential timi…4.7
• CVE-2020-11038In FreeRDP less than or equal to 2.0.0, an Integer Overflow …5.4
• CVE-2020-11039In FreeRDP less than or equal to 2.0.0, when using a manipul…6.8
• CVE-2020-1104A spoofing vulnerability exists when Microsoft SharePoint Se…5.4
• CVE-2020-11040In FreeRDP less than or equal to 2.0.0, there is an out-of-b…2.7
• CVE-2020-11041In FreeRDP less than or equal to 2.0.0, an outside controlle…2.7