CVE-2019-1010310

CVE-2019-1010310 describes a frame and form tag injection vulnerability in GLPI Product version 9.3.1. This flaw allows highly privileged administrators to embed malicious code, such as phishing forms, within reminder descriptions. The attack requires user interaction (clicking a malicious link) and could lead to the compromise of user credentials or other sensitive data, resulting in a low impact on confidentiality and integrity. While the CVSS score is low (3.5), the potential for targeted phishing by an insider is significant. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion regarding this vulnerability.