Vulnerabilidades de Teclib-edition
CVEs publicadas que afetam produtos de Teclib-edition: 4 registro(s), com severidade, exploração e correções.
CVE-2026-25937
Média · 6.5
CWE-287 17/03/2026
GLPI has a MFA bypass
GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials can bypass MFA and steal their account. Version 11.0.6 fixes the issue.
CVE-2026-25936
Alta · 8.8
CWE-89 17/03/2026
GLPI Vulnerable to Authenticated SQL Injection
GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injection. Version 11.0.6 fixes the issue.
CVE-2026-23489
Crítica · 9.1
CWE-20 16/03/2026
Fields GLPI plugin vulnerable to RCE in dropdown generation
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.
CVE-2026-22248
Alta · 8.8
CWE-502 11/03/2026
GLPI affected by Remote Code Execution via malicious upload
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0 to before 11.0.5, an authenticated technician user can upload a malicious file and trigger its execution through an unsafe PHP instantiation. This vulnerability is fixed in 11.0.5.