Untriaged
Permalink
CVE-2026-25936
6.5 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): NONE
- Availability impact (A): NONE
GLPI Vulnerable to Authenticated SQL Injection
GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injection. Version 11.0.6 fixes the issue.
References
- https://github.com/glpi-project/glpi/security/advisories/GHSA-qw3x-7vv2-7759 x_refsource_CONFIRM
Affected products
glpi
- ==>= 11.0.0, < 11.0.6
Package maintainers
-
@liberodark liberodark <liberodark@gmail.com>