CVE-2012-4003: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in GLPI-PROJECT GLPI before 0.83.3 allow remote attackers to inject arbitrary web script or HTML via unknown vectors...

glpi -- SQL Injection

The GLPI project reports: Input passed via unspecified parameters is not properly sanitised before being used in SQL queries. This can be exploited to manipulateSQL queries by injecting arbitrary SQL code...