SEPTEMBER 20, 2026
Live Feed
Back to database
Case File

CVE-2026-53987

MEDIUM · CVSS 6.4 EPSS 0.34% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-09 · Last synced 2026-08-08

CyberRota Analysis

AI-Generated

The Tag plugin for GLPI versions prior to 2.14.4 is vulnerable to stored cross-site scripting due to improper HTML sanitization and output escaping when rendering tag names in the Kanban badge markup. This allows authenticated users with tag management permissions to inject malicious HTML, which can then execute in the browsers of users viewing the affected Kanban boards. Organizations using this plugin should prioritize patching to mitigate potential exploitation risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-53987
Severity
MEDIUM
CVSS
6.4
EPSS
0.34%

Original NVD Description

The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-site scripting. An authenticated user with TAG MANAGEMENT create or update rights can set a tag name containing HTML, which then executes in the browser of any user who opens the Kanban view of a ticket, problem, change, or project the tag is attached to.