CVE-2019-1010307

GLPI GLPI Product 9.3.1 is affected by: Cross Site Scripting XSS. The impact is: All dropdown values are vulnerable to XSS leading to privilege escalation and executing js on admin. The component is: /glpi/ajax/getDropDownValue.php. The attack vector is: 1- User Create a ticket , 2- Admin opens...

PT-2019-11558

Name of the Vulnerable Software and Affected Versions: GLPI version 9.3.1 Description: The issue affects the /glpi/ajax/getDropDownValue.php endpoint, allowing for Cross Site Scripting XSS attacks. This can lead to privilege escalation and the execution of JavaScript code on the admin interface...