CVE-2021-21258: GLPI-Project GLPI

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI from version 9.5.0 and before version 9.5.4, there is a cross-site scripting injection vulnerability when using ajax/kanban.php. This is fixed in version 9.5.4.

Affected products

• GLPI-Project GLPI: from 9.5.0, before 9.5.4 (fixed in 9.5.4)

Published 2021-03-02. Last modified 2026-06-17.