CVE-2023-28639

GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is fixed in versions 9.5.13 and 10.0.7.

• CWE-79

• https://github.com/glpi-project/glpi/releases/tag/10.0.7Patch, Release Notes
• https://github.com/glpi-project/glpi/releases/tag/9.5.13Patch, Release Notes
• https://github.com/glpi-project/glpi/security/advisories/GHSA-r93q-chh5-jgh4Vendor Advisory
• https://github.com/glpi-project/glpi/releases/tag/10.0.7Patch, Release Notes
• https://github.com/glpi-project/glpi/releases/tag/9.5.13Patch, Release Notes
• https://github.com/glpi-project/glpi/security/advisories/GHSA-r93q-chh5-jgh4Vendor Advisory

Published

Apr 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28633GLPI is a free asset and IT management software package. Sta…5.4
• CVE-2023-28634GLPI is a free asset and IT management software package. Sta…8.8
• CVE-2023-28635vantage6 is privacy preserving federated learning infrastruc…5.4
• CVE-2023-28636GLPI is a free asset and IT management software package. Sta…4.8
• CVE-2023-28637DataEase is an open source data visualization analysis tool.…8.8
• CVE-2023-28638Snappier is a high performance C# implementation of the Snap…5.9
• CVE-2023-2864A vulnerability was found in SourceCodester Online Jewelry S…6.1
• CVE-2023-28640Apiman is a flexible and open source API Management platform…3.1
• CVE-2023-28642runc is a CLI tool for spawning and running containers accor…7.8
• CVE-2023-28643Nextcloud server is an open source home cloud implementation…8.8
• CVE-2023-28644Nextcloud server is an open source home cloud implementation…7.5
• CVE-2023-28645Nextcloud richdocuments is a Nextcloud app integrating the o…6.5