Vulnerabilidades de pluginsGLPI
CVEs publicadas que afetam produtos de pluginsGLPI: 4 registro(s), com severidade, exploração e correções.
CVE-2026-23489
Crítica · 9.1
CWE-20 16/03/2026
Fields GLPI plugin vulnerable to RCE in dropdown generation
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.
CVE-2026-22821
Média · 6.5
CWE-89 12/02/2026
mreporting affected by a SQLI on date change
mreporting is the more reporting GLPI plugin. Prior to 1.9.4, there is a possible SQL injection on date change. This vulnerability is fixed in 1.9.4.
CVE-2025-65035
Média · 6.4
CWE-502 19/12/2025
GLPI Database Inventory Plugin Vulnerable to Stored Object Injection
pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. Prior to version 1.1.2, in certain conditions (database write access must first be obtained through another vulnerability or misconfiguration), user-controlled data is stored insecurely in the database via computergroup, and is later unserialized on every page load, allowing arbitrary PHP object instantiation. Version 1.1.2 fixes the issue.
CVE-2025-53360
Média · 4.3
CWE-284 18/11/2025
pluginsGLPI's Database Inventory Plugin allows any authenticated user to send agent requests
pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. In versions prior to 1.0.3, any authenticated user could send requests to agents. This issue has been patched in version 1.0.3.