GLPI 跨站脚本漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

CVE-2023-28639

GLPI CVE-2023-28639 affects GLPI versions prior to 9.5.13 and 10.0.7 (including early 0.85), where an unauthenticated attacker can craft a malicious link that triggers a reflected XSS when an authenticated user opens it. The issue is fixed in versions 9.5.13 and 10.0.7. The vulnerability’s impact...

PT-2023-3267 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions 0.60 through 9.5.12 GLPI versions 10.0.0 through 10.0.6 Description: The issue is related to insufficient cleaning of user data when processing external links, allowing a user to inject and execute arbitrary HTML code and script...

PT-2023-3268 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions 9.5.0 through 9.5.12 GLPI versions 10.0.0 through 10.0.6 Description: The issue is related to insufficient cleaning of user data in the administration panel, allowing a user to inject and execute arbitrary HTML and script code i...

CVE-2023-28849: Improper Neutralization of Special Elements used in an SQL Command

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.7, GLPI inventory endpoint can be used to drive a SQL injection attack. It can also be used to store malicious code that could be used to perform XSS attack. By default, GLPI inventory...

PT-2023-3265 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions 10.0.0 through 10.0.6 Description: The issue is related to insufficient cleaning of user data in the GLPI inventory endpoint, allowing an unauthenticated user to send a specially crafted request to the vulnerable application and...

CVE-2023-29006: Deserialization of Untrusted Data

The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated user that has access to standard interface can craft an URL that can be used to execute a system command. Versions 2.7.7 and 2.10.1 conta...

PT-2023-3282 · Glpi +1 · Fields +1

Name of the Vulnerable Software and Affected Versions: Fields versions prior to 1.13.1 Fields versions prior to 1.20.4 Description: The issue is related to a lack of access control check in the Fields plugin for GLPI, allowing any authenticated user to write data to any fields container, includin...

CVE-2023-28639 GLPI vulnerable to reflected Cross-site Scripting in search pages

GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is...

PT-2023-3261 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions 0.84 through 9.5.12 GLPI versions 10.0.0 through 10.0.6 Description: The issue is related to the usage of RSS feeds in GLPI, which is subject to server-side request forgery SSRF. When the remote address is not a valid RSS feed, ...

GLPI SQL注入漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

GLPI Activity v3.1.0 - Authenticated Local File Inclusion on Activity plugin Vulnerability

Exploit Title: GLPI Activity v3.1.0 - Authenticated Local File Inclusion on Activity plugin Application: GLPI Activity 3.1.0 Author: Nuri Çilengir Vendor Homepage: https://glpi-project.org/ Software Link: https://github.com/InfotelGLPI/activity Advisory:...

GLPI Cartography Shell Upload

Exploit Title: GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution RCE Date of found: 11 Jun 2022 Application: GLPI Cartography...

GLPI 10.0.2 SQL Injection / Remote Code Execution

ADVISORY INFORMATION Exploit Title: GLPI v10.0.2 - SQL Injection Authentication Depends on Configuration Date of found: 11 Jun 2022 Application: GLPI =10.0.0, 10.0.3 Author: Nuri Çilengir Vendor Homepage: https://glpi-project.org/ Software Link: https://github.com/glpi-project/glpi Advisory:...

GLPI 代码问题漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

GLPI Glpiinventory v1.0.1 - Unauthenticated Local File Inclusion

ADVISORY INFORMATION Exploit Title: GLPI Glpiinventory v1.0.1 - Unauthenticated Local File Inclusion Date of found: 11 Jun 2022 Application: GLPI Glpiinventory = 1.0.1 Author: Nuri Çilengir Vendor Homepage: https://glpi-project.org/ Software Link:...

GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution Vulnerability

Exploit Title: GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution RCE Application: GLPI Cartography...

GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure

Exploit Title: GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure Date: 11 Jun 2022 Version: =10.0.0 and 10.0.2 Author: Nuri Çilengir Vendor Homepage: https://glpi-project.org/ Software Link: https://github.com/glpi-project/glpi Advisory:...

GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure Vulnerability

Exploit Title: GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure Version: =10.0.0 and 10.0.2 Author: Nuri Çilengir Vendor Homepage: https://glpi-project.org/ Software Link: https://github.com/glpi-project/glpi Advisory:...

GLPI v10.0.2 - SQL Injection (Authentication Depends on Configuration) Vulnerability

ADVISORY INFORMATION Exploit Title: GLPI v10.0.2 - SQL Injection Authentication Depends on Configuration Application: GLPI =10.0.0, 10.0.3 Author: Nuri Çilengir Vendor Homepage: https://glpi-project.org/ Software Link: https://github.com/glpi-project/glpi Advisory:...