CVE-2025-66417

High CVSS: 7.5

GLPI is a free asset and IT management software package. From 11.0.0, < 11.0.3, an unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 11.0.3.

Vendor

Glpi-project

Product

Glpi

CWE

CWE-89

Yayın Tarihi

2026-01-15 17:16:04

Güncelleme

2026-01-21 20:54:11

Source Identifier

security-advisories@github.com

KEV Date Added

Kategoriler

CWE-89 Glpi HIGH Glpi-project 2026

Referanslar

https://github.com/glpi-project/glpi/security/advisories/GHSA-p467-682w-9cc9

Benzer Kayıtlar

High

CVE-2026-26001

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents…

Medium

CVE-2026-25590

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents…

Medium

CVE-2026-22821

mreporting is the more reporting GLPI plugin. Prior to 1.9.4, there is a possible SQL injection on date change. This vul…

Medium

CVE-2026-22044

GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can…

Medium

CVE-2026-22247

GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can…

Medium

CVE-2026-23624

GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.…