CVE-2024-47759
GLPI has a stored XSS via document upload
GLPI is a free Asset and IT management software package. An technician can upload a SVG containing a malicious script. The script will then be executed when any user will try to see the document contents. Upgrade to 10.0.17.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
glpi-project · glpiWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →