{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/glpi--10.0.27/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GLPI (\u003c 10.0.27)","GLPI (11.0.x \u003c 11.0.9)"],"_cs_severities":["high"],"_cs_tags":["webserver","sql-injection","xss","patch-management"],"_cs_type":"advisory","_cs_vendors":["GLPI"],"content_html":"\u003cp\u003eThe French National Cybersecurity Agency (ANSSI) has released an advisory regarding multiple vulnerabilities in the GLPI software. The identified flaws permit attackers to conduct SQL injection (SQLi) attacks, execute remote cross-site scripting (XSS), bypass security policies, and manipulate data integrity. These vulnerabilities affect GLPI versions 10.0.x prior to 10.0.27 and 11.0.x prior to 11.0.9.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized data manipulation, security policy circumvention, and the execution of malicious scripts in the context of user sessions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all internal deployments of GLPI to identify affected versions.\u003c/li\u003e\n\u003cli\u003eApply the latest security patches provided by the GLPI project by upgrading to versions 10.0.27 or 11.0.9 or later.\u003c/li\u003e\n\u003cli\u003eRefer to the security advisories published on the GLPI GitHub security page (GHSA-3rr2-mxv6-rmc2, GHSA-5jg3-2qx2-gq7g, GHSA-753w-2942-4pxm, GHSA-75jp-p2vm-9vmh, GHSA-7x93-gxc8-jp8m, GHSA-hv93-qr6v-7mpj, GHSA-pr87-h373-xr6c) for specific mitigation details per CVE.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T17:39:00Z","date_published":"2026-10-27T17:39:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-glpi-vulnerabilities/","summary":"Multiple vulnerabilities in GLPI allow remote attackers to perform SQL injection, cross-site scripting, and security policy bypass, resulting in data integrity loss.","title":"GLPI Multiple Vulnerabilities","url":"https://feed.craftedsignal.io/briefs/2026-10-glpi-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - GLPI (\u003c 10.0.27)","version":"https://jsonfeed.org/version/1.1"}