CVE-2026-55214

— UNSCOREDpublic exploit available

Published 2026-09-25 · Updated 2026-09-25

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.

Weaknesses

CWE-116

Public exploit & PoC references

https://github.com/glpi-project/glpi/commit/970786ed3b817c4c2bf90b8457b024ec566b1bfc
https://github.com/glpi-project/glpi/releases/tag/11.0.8
https://github.com/glpi-project/glpi/security/advisories/GHSA-8v8p-w8mq-wqcg

All references

https://github.com/glpi-project/glpi/commit/970786ed3b817c4c2bf90b8457b024ec566b1bfc
https://github.com/glpi-project/glpi/releases/tag/11.0.8
https://github.com/glpi-project/glpi/security/advisories/GHSA-8v8p-w8mq-wqcg

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-13635
CRITICALCVE-2026-13684
MEDIUMCVE-2026-58504PoC
MEDIUMCVE-2026-61784PoC
UNSCOREDCVE-2026-63208PoC
MEDIUMCVE-2026-63329PoC
UNSCOREDCVE-2026-77404PoC
UNSCOREDCVE-2026-82409PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.