CVE-2023-22725

GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 are vulnerable to Cross-site Scripting. This vulnerability allow for an administrator to create a malicious external link. This issue is patched in 10.0.6.

• CWE-79

• https://github.com/glpi-project/glpi/security/advisories/GHSA-f5g6-fxrw-pfj7Third Party Advisory
• https://github.com/glpi-project/glpi/security/advisories/GHSA-f5g6-fxrw-pfj7Third Party Advisory

Published

Jan 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22719Improper Neutralization of Formula Elements in a CSV File vu…9.8
• CVE-2023-2272The Tiempo.com WordPress plugin through 0.1.2 does not sanit…6.1
• CVE-2023-22720Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulne…5.4
• CVE-2023-22721Auth. Stored Cross-Site Scripting (XSS) in Oi Yandex.Maps fo…5.4
• CVE-2023-22722GLPI is a Free Asset and IT Management Software package. Ver…6.1
• CVE-2023-22724GLPI is a Free Asset and IT Management Software package. Ver…4.8
• CVE-2023-22726act is a project which allows for local running of github ac…8.8
• CVE-2023-22727CakePHP is a development framework for PHP web apps. In affe…9.8
• CVE-2023-22728Silverstripe Framework is the Model-View-Controller framewor…4.3
• CVE-2023-22729Silverstripe Framework is the Model-View-Controller framewor…6.1
• CVE-2023-2273Rapid7 Insight Agent token handler versions 3.2.6 and below,…7.5
• CVE-2023-22730Shopware is an open source commerce platform based on Symfon…7.5