VulnSocial

CVE-2026-25932Disclosure(glpi-project / glpi)

LOWCVSS 4.8 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch glpi-project glpi systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier fields. This vulnerability is fixed in 10.0.24.

glpi-project CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-79CWE-116

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • glpi

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-04-06); latest day: 1
  • 4 total mentions across 3 days

Affected systems

Vendors
glpi-project
Products
glpi

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-03-03: 1Mentions · 2026-04-06: 2Mentions · 2026-04-07: 1Patch / Workaround · 2026-03-03: 1Technical Details · 2026-03-03: 1Technical Details · 2026-04-06: 203-0304-0604-07
Signal classification3 categories
Disclosure
250.0%
Patch
125.0%
General
125.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-03-031
Patch1
2026-04-062
Disclosure2
2026-04-071
General1
Full discourse4 posts
  • Firmis Labs@FirmisLabs
    General

    CVE-2026-25932 · NIST 7.2/10 https://nvd.nist.gov/vuln/detail/CVE-2026-25932

    Post summary

    The content references CVE-2026-25932 and its NIST score but offers no further detail or actionable information.

    1000028
    1 followersView on X
  • GLPI-PROJECT.ORG@GLPI_PROJECT
    Patch

    2️⃣ GLPI 10.0.24 : Also, an XSS ([SECURITY - High] Stored XSS in Supplier CVE-2026-25932) and [SECURITY - High] Authenticated SQL Injection (CVE requested) have been detected on 10.0 branch, so a new version is also available today.

    Post summary

    GLPI 10.0.24 release includes patches for a stored XSS (CVE-2026-25932) and an authenticated SQL injection, addressing high severity vulnerabilities.

    1000087
    2.1K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-25932 GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier fields. … https://www.cve.org/CVERecord?id=CVE-2026-25932 ----- Traducción: CVE-2026-25932 GLP… http://infoflow.cloud`

    Post summary

    The post announces CVE‑2026‑25932, describing it as an XSS flaw in GLPI that allows authenticated technician users to inject payloads into supplier fields.

    0000039
    67 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-25932 GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier fields. … https://www.cve.org/CVERecord?id=CVE-2026-25932

    Post summary

    The message details an XSS flaw in GLPI versions prior to 10.0.24 that allows authenticated technicians to store malicious payloads, but no PoC, patch, or exploitation evidence is provided.

    00000152
    57.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appglpi-projectglpi---

Explore more

Back to dashboardglpi-project CVEsglpi vulnerabilities