CVE-2022-34125: Exposure of Sensitive Information to an Unauthorized Actor

front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive information via a log/ pathname in the file parameter...

CVE-2022-34127

The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter...

PT-2023-13340 · Glpi · Glpi Cartography Plugin

Name of the Vulnerable Software and Affected Versions: GLPI Cartography plugin versions prior to 6.0.1 Description: The issue allows remote code execution via PHP code in the POST data to "front/upload.php". This enables an attacker to execute arbitrary PHP code on the server. Recommendations: Fo...

CVE-2022-34126

The vulnerability CVE-2022-34126 affects the GLPI Activity plugin prior to 3.1.1. Root cause: directory traversal in the front/cra.send.php parameter allows reading local files. Impact: potential exposure of sensitive information due to unauthorized local file access. Affected component: GLPI Act...

CVE-2022-34126

The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter...

CVE-2022-34128

The Cartography aka positions plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php...

CVE-2022-34128

The Cartography aka positions plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php...

CVE-2022-34127: Improper Limitation of a Pathname to a Restricted Directory

The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter...

CVE-2022-34126: Improper Limitation of a Pathname to a Restricted Directory

The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter...

CVE-2022-34125

front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive information via a log/ pathname in the file parameter...

CVE-2022-34126

The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter...

CVE-2022-34128

The Cartography aka positions plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php...

CVE-2022-34127

The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter...

CVE-2022-34128

The CVE-2022-34128 entry applies to the GLPI Cartography plugin (aka positions) version prior to 6.0.1, where the vulnerability allows remote code execution by sending PHP code in the POST data to front/upload.php. Technical evidence in connected sources confirms an unauthenticated RCE vector via...

CVE-2022-34128: Unrestricted Upload of File with Dangerous Type

The Cartography aka positions plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php...

CVE-2022-34127

The CVE-2022-34127 entry describes a directory traversal/local file inclusion in GLPI’s Manageentities plugin before 4.0.2. The vulnerability arises in inc/cri.class.php, enabling unauthenticated access to local files. Public materials (Exploit-DB) include a PoC demonstrating LFI against the plug...

CVE-2022-34127

The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter...

CVE-2022-34126

The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter...

CVE-2023-28849

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.7, GLPI inventory endpoint can be used to drive a SQL injection attack. It can also be used to store malicious code that could be used to perform XSS attack. By default, GLPI inventory...

CVE-2023-28852

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 9.5.13 and 10.0.7, a user with dashboard administration rights may hack the dashboard form to store malicious code that will be executed when other users will use the related dashboard. Versio...