CVE-2025-21627

GLPI is a free asset and IT management software package. In versions prior to 10.0.18, a malicious link can be crafted to perform a reflected XSS attack on the search page. If the anonymous ticket creation is enabled, this attack can be performed by an unauthenticated user. Version 10.0.18 contains a fix for the issue.

• CWE-79

• https://github.com/glpi-project/glpi/security/advisories/GHSA-qm8p-jmj2-qfc2Vendor Advisory

Published

Feb 25, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-21620Deno is a JavaScript, TypeScript, and WebAssembly runtime wi…7.5
• CVE-2025-21621GeoServer is an open source server that allows users to shar…6.1
• CVE-2025-21622ClipBucket V5 provides open source video hosting with PHP. D…9.1
• CVE-2025-21623ClipBucket V5 provides open source video hosting with PHP. P…7.5
• CVE-2025-21624ClipBucket V5 provides open source video hosting with PHP. P…9.8
• CVE-2025-21626GLPI is a free asset and IT management software package. Sta…6.5
• CVE-2025-21628Chatwoot is a customer engagement suite. Prior to 3.16.0, co…8.8
• CVE-2025-21629In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-2163The Zoorum Comments plugin for WordPress is vulnerable to Cr…5.4
• CVE-2025-21630Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-21631In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-21632In the Linux kernel, the following vulnerability has been re…5.5