PT-2025-12806 · Glpi +1 · Glpi Inventory Plugin +1

Name of the Vulnerable Software and Affected Versions: GLPI Inventory Plugin versions prior to 1.5.0 Description: The GLPI Inventory Plugin handles various tasks for GLPI agents, including network discovery and inventory, software deployment, and data collection. It has an improper access control...

webERP 代码注入漏洞

webERP is an open source inventory and financial management system ERP system by Tim Schofield, an individual developer. The system supports inventory management, rights role management, order management and financial management. A code injection vulnerability exists in webERP 5.0.0.rc+13 and pri...

The vulnerability of the Inventory module in the GLPI system, which handles requests, incidents, and inventory management of computer equipment, allows a perpetrator to execute arbitrary codes.

The vulnerability of the Inventory module in the GLPI system, which handles requests, incidents, and inventory management of computer equipment, involves unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Inventory module in the GLPI system, which handles requests, incidents, and inventory management of computer equipment, allows a hacker to execute arbitrary SQL commands.

The vulnerability of the Inventory module in the GLPI system for job requests, incidents, and computer equipment inventory relates to the improper elimination of special elements used in SQL queries. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely...

UBUNTU-CVE-2025-24799

GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18...

CVE-2025-24799 GLPI allows unauthenticated SQL injection through the inventory endpoint

GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18...

CVE-2025-24799 GLPI allows unauthenticated SQL injection through the inventory endpoint

GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18...

CVE-2025-24799

GLPI pre-auth SQL injection in the Inventory feature affects versions up to 10.0.17 due to insufficient sanitization of XML input in handleAgent, where SimpleXMLElement objects can bypass dbEscapeRecursive and allow arbitrary SQL via the inventory endpoint. Impact: unauthenticated access to data....

GLPI SQL注入漏洞

GLPI is an open source IT and asset management software from GLPI Open Source. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

CVE-2025-26626

The GLPI Inventory Plugin handles various types of tasks for GLPI agents for the GLPI asset and IT management software package. Versions prior to 1.5.0 are vulnerable to reflective cross-site scripting, which may lead to executing javascript code. Version 1.5.0 fixes the issue...

CVE-2025-26626

The GLPI Inventory Plugin handles various types of tasks for GLPI agents for the GLPI asset and IT management software package. Versions prior to 1.5.0 are vulnerable to reflective cross-site scripting, which may lead to executing javascript code. Version 1.5.0 fixes the issue...

CVE-2025-26626 GLPI Inventory Plugin vulnerable to reflective Cross-site Scripting

The GLPI Inventory Plugin handles various types of tasks for GLPI agents for the GLPI asset and IT management software package. Versions prior to 1.5.0 are vulnerable to reflective cross-site scripting, which may lead to executing javascript code. Version 1.5.0 fixes the issue...

CVE-2025-26626 GLPI Inventory Plugin vulnerable to reflective Cross-site Scripting

The GLPI Inventory Plugin handles various types of tasks for GLPI agents for the GLPI asset and IT management software package. Versions prior to 1.5.0 are vulnerable to reflective cross-site scripting, which may lead to executing javascript code. Version 1.5.0 fixes the issue...

CVE-2025-26626 GLPI Inventory Plugin vulnerable to reflective Cross-site Scripting

The GLPI Inventory Plugin handles various types of tasks for GLPI agents for the GLPI asset and IT management software package. Versions prior to 1.5.0 are vulnerable to reflective cross-site scripting, which may lead to executing javascript code. Version 1.5.0 fixes the issue...

CVE-2025-26626

GLPI Inventory Plugin (for GLPI) is affected by a reflective cross-site scripting vulnerability in versions prior to 1.5.0. The issue allows execution of JavaScript code and is tracked as CVE-2025-26626. A fixed release is 1.5.0. The CVSSv3.1 base score is 6.5 (MEDIUM), with network attack vector...

GLPI Inventory Plugin 跨站脚本漏洞

GLPI Inventory Plugin is an open source plugin for GLPI France. It is used to handle various types of tasks for GLPI agents. A cross-site scripting vulnerability exists in GLPI Inventory Plugin versions prior to 1.5.0, which stems from reflective cross-site scripting and could lead to the executi...

GLPI Inventory Plugin Unauthenticated Blind Boolean SQLi

GLPI use auxiliary/gather/glpi/inventorypluginunauthsqli msf undefinedinventorypluginunauthsqli show actions ...actions... msf undefinedinventorypluginunauthsqli set ACTION msf undefinedinventorypluginunauthsqli show options ...show and set options... msf undefinedinventorypluginunauthsqli run Th...

Gradio UI Detection

The remote web server hosts Gradio UI web application %NASLMINLEVEL 80900 Tenable, Inc. include'compat.inc'; if description scriptid232290; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate", value:"2026/03/18"; scriptnameenglish:"Gradio UI Detection";...

CVE-2025-26849

There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be used to decrypt inventory files that contain sensitive information such as firewall rules...

CVE-2025-26849

There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be used to decrypt inventory files that contain sensitive information such as firewall rules...