CVE-2025-21626 GLPI vulnerable to exposure of sensitive information in the `status.php` endpoint

GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the status.php endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the status.p...

CVE-2025-21626

GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the "status.php" endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the...

CVE-2025-21626: Exposure of Sensitive Information to an Unauthorized Actor

GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the status.php endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the status.p...

PT-2025-6928 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions 0.71 through 10.0.17 Description: The issue allows an anonymous user to fetch sensitive information from the "status.php" endpoint. There is no information about the estimated number of potentially affected devices worldwide or...

CVE-2024-10154: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in PHPGurukul Boat Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file status.php of the component Check Booking Status Page. The manipulation of the argument emailid leads to sql injection. The attack may be...

CVE-2024-8416

SourceCodester Food Ordering Management System 1.0 contains a SQL injection in /routers/ticket-status.php via the ticket_id parameter. The vulnerability is exploitable remotely and has been disclosed publicly. Root cause: improper handling of the ticket_id input leading to SQL injection. Impact r...

CVE-2024-8416: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Food Ordering Management System 1.0. It has been classified as critical. This affects an unknown part of the file /routers/ticket-status.php. The manipulation of the argument ticketid leads to sql injection. It is possible to initiate the attack remotel...

PT-2024-15579

Name of the Vulnerable Software and Affected Versions code-projects Online Faculty Clearance version 1.0 Description A critical issue has been found in the code-projects Online Faculty Clearance software. The problem affects an unknown functionality of the file /production/designee view status.ph...

CVE-2023-6074

CVE-2023-6074 affects PHPGurukul Restaurant Table Booking System v1.0, specifically the check-status.php in the Booking Reservation Handler. The vulnerability is a SQL injection stemming from processing in that file, with remote exploitation implied. Connected sources (PT-Security PT-2023-32499, ...

CVE-2023-6074: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0. It has been rated as critical. This issue affects some unknown processing of the file check-status.php of the component Booking Reservation Handler. The manipulation leads to sql injection. The attack may be initiated...

SUSE CVE-2017-11631

dapur/app/appuser/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter...

PT-2022-20139

Name of the Vulnerable Software and Affected Versions Badminton Center Management System version 1.0 Description The issue concerns SQL Injection via the id parameter in the "/bcms/admin/court rentals/update status.php" API endpoint. This allows for potential manipulation of database queries...

PT-2022-20704

Name of the Vulnerable Software and Affected Versions Online Car Wash Booking System version 1.0 Description The issue concerns SQL Injection via the /ocwbs/admin/bookings/update status.php?id= endpoint. This allows for potential manipulation of database queries using the id parameter...

PT-2022-20107

Name of the Vulnerable Software and Affected Versions Covid-19 Travel Pass Management System version 1.0 Description The Covid-19 Travel Pass Management System is affected by a SQL Injection issue. This issue can be exploited via the /ctpms/admin/applications/update status.php API endpoint,...

PT-2022-20104

Name of the Vulnerable Software and Affected Versions Covid-19 Travel Pass Management System version 1.0 Description The issue concerns a SQL Injection vulnerability. It can be exploited via the /ctpms/admin/individuals/update status.php endpoint, specifically through the id parameter...

SOPlanning Cross-Site Scripting Vulnerability

SOPlanning is an online planning tool for efficiently organizing projects and tasks. A cross-site scripting vulnerability exists in SOPlanning 1.45. An attacker can exploit this vulnerability to execute arbitrary javascript via Name or Comment in status.php...

CVE-2020-9339

SOPlanning 1.45 allows XSS via the Name or Comment to status.php...

Session fixation

SOPlanning 1.45 allows XSS via the Name or Comment to status.php...

CVE-2020-9339

SOPlanning 1.45 allows XSS via the Name or Comment to status.php...

CVE-2020-9339

SOPlanning 1.45 allows XSS via the Name or Comment to status.php...