UpHeron
All vulnerabilities

Servers and applications

CVE-2019-1010307

GLPI GLPI Product 9.3.1 is affected by: Cross Site Scripting (XSS). The impact is: All dropdown values are vulnerable to XSS leading to privilege escalation and executing js on admin. The component is: /glpi/ajax/getDropDownValue.php. The attack vector is: 1- User Create a ticket , 2- Admin opens another ticket and click on the "Link Tickets" feature, 3- a request to the endpoint fetches js and…

Severity
Medium 5.4
Published
15 Jul 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
0.7% in the next 30 daysHigher than 55% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
GLPIServers and applications · cpe:a:glpi-project:glpi
  • Version 9.3.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-1010307
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-1010307