CVE-2026-53987

🎯 CVE-2026-53987 🧪 PoC 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-53987 | The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-site scripting. An authenticated user with TAG MANAGEMENT create or update rights can set a tag name containing HTML, which then executes in the browser of any user who opens the Kanban view of a ticket, problem, change, or project the tag is a

The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-site scripting. An authenticated user with TAG MANAGEMENT create or update rights can set a tag name containing HTML, which then executes in the browser of any user who opens the Kanban view of a ticket, problem, change, or project the tag is attached to.

Klassifikation & Betroffenheit:

CWE-79 Tag plugin GLPI 11 2.6.0 <2.14.4

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 🎯 High

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

🛡️ Empfohlene Mitigation: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and …

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-63 · Cross-Site Scripting (XSS) (Very High) CAPEC-85 · AJAX Footprinting (Low) CAPEC-209 · XSS Using MIME Type Mismatch (Medium) CAPEC-588 · DOM-Based XSS (Very High) CAPEC-591 · Reflected XSS (Very High) CAPEC-592 · Stored XSS (Very High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2025-70038 8.8 CVE-2024-11115 8.8 CVE-2024-51377 8.8 CVE-2024-51180 8.8 CVE-2024-51181 8.8

🩹 Patch verfügbar (OSV):

🩹 49e6b6eb5f83bcd84139a5e5ec54c0ddd14acc90 (Commit)

📰 Eigene Berichterstattung: ➔ CVE-2026-53987 | GLPI Project GLPI 11 up to 2.14.3 Tag preKanbanContent tag name

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 07/2026

Heute 31.10.

CVSS-Vektor-Analyse: 7.3

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Hoch

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CNA-Bewertung (VulnCheck): 7.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA…

Veröffentlicht:09.07.2026

Aktualisiert:29.10.2026 21:17

Assigner (CNA):VulnCheck

EUVD-ID:EUVD-2026-42614

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-79 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	743	0,2 %
≥50 %	3.225	0,8 %
≥10 %	22.059	5,8 %
<10 %	354.702	93,2 %

7.3 HIGH

EPSS

0.5%

CVE-2026-53987 🌐 Netzwerk (Remote) 🔐 Admin-Rechte nötig

Tag plugin

CVE-2026-53987 | The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-site scripting. An authenticated user with TAG MANAGEMENT create or update rights can set a tag name containing HTML, which then executes in the browser of any user who opens the Kanban view of a ticket, problem, change, or project the tag is a

CWE-79 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 3 Monaten ↻ vor 3 Monaten

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub