Read the docs
TI-2022-18638 Aliases CVE-2022-39262

Stored Cross-Site Scripting (XSS) on login page in GLPI

Priority MEDIUM 57CWE-83Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is can contains malicious code that can be used to steal credentials. This issue has been patched, please upgrade to version 10.0.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00807 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed glpi (glpi-project): 10.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
glpi-projectglpibefore 10.0.410.0.4Patch availableCNA
  • glpi Vendorglpi-project Affected before 10.0.4 Fixed in 10.0.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*0.65 to before 10.0.4Vulnerableglpi-project
  • cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:* Versions 0.65 to before 10.0.4 Vulnerable ·glpi-project

Remediation

  • Fix · CNA glpi (glpi-project) Fixed in 10.0.4

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39262

References

Exploit 1

Advisory 1

  • TI-2022-16341 /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18516 GLPI allows unauthenticated SQL injection through the inventory endpoint CVSS 3.1CRITICAL 9.8
  • TI-2023-25210 GLPI SQL injection through inventory agent request CVSS 3.1CRITICAL 9.8
  • TI-2023-17986 GLPI vulnerable to SQL injection via inventory agent request CVSS 3.1CRITICAL 9.8
  • TI-2022-13106 SQL injection on login page in GLPI CVSS 3.1CRITICAL 9.8
  • TI-2023-18602 GLPI vulnerable to SQL injection through Computer Virtual Machine information CVSS 3.1CRITICAL 9.8
See all 187 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences