CVE-2021-21325: GLPI-Project GLPI

Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days.

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 a new budget type can be defined by user. This input is not correctly filtered. This results in a cross-site scripting attack. To exploit this endpoint attacker need to be authenticated. This is fixed in version 9.5.4.

Affected products

• GLPI-Project GLPI: before 9.5.4 (fixed in 9.5.4)

Published 2021-03-08. Last modified 2026-06-17.