CVE-2022-24869

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can use ticket's followups or setup login messages with a stylesheet link. This may allow for a cross site scripting attack vector. This issue is partially mitigated by cors security of browsers, though users are still advised to upgrade.

• CWE-79
• CWE-79

• https://github.com/glpi-project/glpi/blob/10.0/bugfixes/CHANGELOG.md#1000-2022-04-20Release Notes, Third Party Advisory
• https://github.com/glpi-project/glpi/commit/ac9f1f03c5d2545b7e290197dbfebc3f752f810ePatch, Third Party Advisory
• https://github.com/glpi-project/glpi/releases/tag/10.0.0Release Notes, Third Party Advisory
• https://github.com/glpi-project/glpi/security/advisories/GHSA-p94c-8qp5-gfpxThird Party Advisory
• https://github.com/glpi-project/glpi/blob/10.0/bugfixes/CHANGELOG.md#1000-2022-04-20Release Notes, Third Party Advisory
• https://github.com/glpi-project/glpi/commit/ac9f1f03c5d2545b7e290197dbfebc3f752f810ePatch, Third Party Advisory
• https://github.com/glpi-project/glpi/releases/tag/10.0.0Release Notes, Third Party Advisory
• https://github.com/glpi-project/glpi/security/advisories/GHSA-p94c-8qp5-gfpxThird Party Advisory

Published

Apr 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24863http-swagger is an open source wrapper to automatically gene…7.5
• CVE-2022-24864Origin Protocol is a blockchain based project. The Origin Pr…5.4
• CVE-2022-24865HumHub is an Open Source Enterprise Social Network. In affec…6.5
• CVE-2022-24866Discourse Assign is a plugin for assigning users to a topic …4.3
• CVE-2022-24867GLPI is a Free Asset and IT Management Software package, tha…7.5
• CVE-2022-24868GLPI is a Free Asset and IT Management Software package, tha…5.4
• CVE-2022-2487A vulnerability has been found in WAVLINK WN535K2 and WN535K…9.8
• CVE-2022-24870Combodo iTop is a web based IT Service Management tool. In 3…5.4
• CVE-2022-24871Shopware is an open commerce platform based on Symfony Frame…5.5
• CVE-2022-24872Shopware is an open commerce platform based on Symfony Frame…8.1
• CVE-2022-24873Shopware is an open source e-commerce software platform. Pri…6.1
• CVE-2022-24874Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…