CVE-2024-27104

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject to an XSS attack. This issue has been patched in version 10.0.13.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-271056.5Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed using certain endpo CVE-2024-271065.7Vulnerable data in transit in GE HealthCare EchoPAC products CVE-2024-271079.6Weak account password in GE HealthCare EchoPAC products CVE-2024-271086.8Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products CVE-2024-271097.6Insufficiently protected credentials in GE HealthCare EchoPAC products CVE-2024-27118.8A vulnerability was found in Tenda AC10U 15.03.06.48. It has been rated as critical. Affected by this issue is the function addWifiMacFilter CVE-2024-271108.4Elevation of privilege vulnerability in GE HealthCare EchoPAC products CVE-2024-271129.8A unauthenticated SQL Injection has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker coul CVE-2024-271139.8An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the publi CVE-2024-271149.8A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. If the public view setting is CVE-2024-271159.8A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. With this vulnerability, an at CVE-2024-27126.5A vulnerability, which was classified as critical, has been found in Campcodes Complete Online DJ Booking System 1.0. This issue affects som