CVE-2023-22724

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting (XSS) payloads inside RSS links. Victims who wish to visit an RSS content and click on the link will execute the Javascript. This issue is patched in 10.0.6.

• CWE-79

• https://github.com/glpi-project/glpi/security/advisories/GHSA-x9g4-j85w-cmffThird Party Advisory
• https://github.com/glpi-project/glpi/security/advisories/GHSA-x9g4-j85w-cmffThird Party Advisory

Published

Jan 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22718Reflected Cross-Site Scripting (XSS) vulnerability in Jason …6.1
• CVE-2023-22719Improper Neutralization of Formula Elements in a CSV File vu…9.8
• CVE-2023-2272The Tiempo.com WordPress plugin through 0.1.2 does not sanit…6.1
• CVE-2023-22720Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulne…5.4
• CVE-2023-22721Auth. Stored Cross-Site Scripting (XSS) in Oi Yandex.Maps fo…5.4
• CVE-2023-22722GLPI is a Free Asset and IT Management Software package. Ver…6.1
• CVE-2023-22725GLPI is a Free Asset and IT Management Software package. Ver…4.8
• CVE-2023-22726act is a project which allows for local running of github ac…8.8
• CVE-2023-22727CakePHP is a development framework for PHP web apps. In affe…9.8
• CVE-2023-22728Silverstripe Framework is the Model-View-Controller framewor…4.3
• CVE-2023-22729Silverstripe Framework is the Model-View-Controller framewor…6.1
• CVE-2023-2273Rapid7 Insight Agent token handler versions 3.2.6 and below,…7.5