Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2026-26027

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6.

VectorNETWORK

PublishedApr 06, 2026, 15:17

Published Bysecurity-advisories@github.com

Base Score

Score6.1

Affected Versions

No affected versions found.

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-chch-wcm9-f9cp

Weakness Type

CWE-79

CVSS Metrics

Base Score

6.1

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK