Medium severity · published Mar 3, 2026
CVE-2026-25590
GLPI Inventory Plugin has Reflected XSS in task jobs
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, there is a reflected XSS vulnerability in task jobs. This vulnerability is fixed in 1.6.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
glpi-inventory-plugin · glpi-project
< 1.6.6 · source: vendor
GI
Glpi Inventory · Glpi-project
before 1.6.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25590
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25590
Vendor Advisory
https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-54x7-6fhx-3wmw
More from glpi-inventory-plugin
8.8
CVE-2026-26001
GLPI Inventory Plugin has SQL Injection on dropdown_calendar Report
8.2
CVE-2025-27147
GLPI Inventory plugin has Improper Access Control Vulnerability
7.5
CVE-2025-32786
GLPI Inventory Plugin is Vulnerable to Unauthenticated SQL Injection
6.5
CVE-2025-26626
GLPI Inventory Plugin vulnerable to reflective Cross-site Scripting