Xanhacks

The issue concerns cross-site scripting via malicious RSS feeds. An administrator can import a malicious RSS feed containing Cross Site Scripting (XSS) payloads inside RSS links. When victims visit the RSS content and click on the link, they will execute the Javascript.

The issue allows an administrator to store malicious code in an entity name. This can potentially lead to security breaches. The estimated number of potentially affected devices is not specified.

The issue is related to improper input validation in the GLPI system, which can be exploited by a remote attacker to impact the system's integrity. Users may be able to inject custom field values in `mailto` links.

The issue is related to the improper neutralization of input data during web page generation, which may allow a remote attacker to execute arbitrary code. Users may be able to create a public RSS feed to inject malicious code in dashboards of other users.

The issue is related to Cross-site Scripting, where an administrator can store malicious code in help links. This can be exploited by a remote attacker to save arbitrary code in the help links. The problem is patched in version 10.0.6.