GLPI is a free asset and IT management software package. In versions prior to 10.0.18, a malicious link can be crafted to perform a reflected XSS attack on the search page. If the anonymous ticket creation is enabled, this attack can be performed by an unauthenticated user. Version 10.0.18 contains a fix for the issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GLPI is a free asset and IT management software package. In versions prior to 10.0.18, a malicious link     can be crafted to perform a reflected XSS attack on the search page. If the anonymous ticket creation is     enabled, this attack can be performed by an unauthenticated user. Version 10.0.18 contains a fix for the     issue. (CVE-2025-21627)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the c36decbe-3c84-11f0-8d29-b42e991fc52e advisory.

    security-advisories@github.com reports:

              CVE-2024-11955: A vulnerability was found in GLPI up to               10.0.17. It has been declared as problematic. Affected by               this vulnerability is an unknown functionality of the file               /index.php.
              The manipulation of the argument redirect leads to               open redirect. The attack can be launched remotely.
              The exploit has been disclosed to the public and               may be used. Upgrading to version 10.0.18 is able to               address this issue.
              It is recommended to upgrade the affected component.


              CVE-2025-23024: Starting in version 0.72 and prior to               version 10.0.18, an anonymous user can disable all the               active plugins. Version 10.0.18 contains a patch.
              As a workaround, one may delete the `install/update.php`               file.


              CVE-2025-23046: Prior to version 10.0.18, a low privileged               user can enable debug mode and access sensitive information.
              Version 10.0.18 contains a patch.
              As a workaround, one may delete the `install/update.php`               file.


              CVE-2025-25192: Starting in version 9.5.0 and prior to               version 10.0.18, if a Mail servers               authentication provider is configured to use an Oauth               connection provided by the OauthIMAP plugin, anyone can               connect to GLPI using a user name on which an Oauth               authorization has already been established.
              Version 10.0.18 contains a patch. As a               workaround, one may disable any Mail               servers authentication provider configured to               use an Oauth connection provided by the OauthIMAP               plugin.


              CVE-2025-21626: Starting in version 0.71 and prior to               version 10.0.18, an anonymous user can fetch sensitive               information from the `status.php` endpoint.
              Version 10.0.18 contains a fix for the issue.
              Some workarounds are available. One may delete the               `status.php` file, restrict its access, or               remove any sensitive values from the `name` field of               the active LDAP directories, mail servers authentication               providers and mail receivers.


              CVE-2025-21627: In versions prior to 10.0.18, a malicious               link can be crafted to perform a reflected XSS attack on the               search page. If the anonymous ticket creation is enabled,               this attack can be performed by an unauthenticated               user. Version 10.0.18 contains a fix for the issue.


              CVE-2025-21619: An administrator user can perfom a SQL               injection through the rules configuration forms.
              This vulnerability is fixed in 10.0.18.


              CVE-2025-24799: An unauthenticated user can perform a SQL               injection through the inventory endpoint.
              This vulnerability is fixed in 10.0.18.


              CVE-2025-24801: An authenticated user can upload and force               the execution of *.php files located on the GLPI server.
              This vulnerability is fixed in 10.0.18.


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
264325	Linux Distros Unpatched Vulnerability : CVE-2025-21627	Nessus	Misc.	medium
237566	FreeBSD : glpi-project -- GLPI multiple vulnerabilities (c36decbe-3c84-11f0-8d29-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2025-21627

medium

Tenable Plugins

medium

high