CVE-2024-29889

HIGH NUCLEI

GLPI <10.0.15 - SQL Injection

Title source: llm

Description

GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. This vulnerability is fixed in 10.0.15.

Nuclei Templates (1)

GLPI 10.0.10-10.0.14 - SQL Injection
HIGHVERIFIEDby iamnoooob,rootxharsh,pdresearch
Shodan: http.title:"glpi"

References (2)

Scores

CVSS v3 7.1
EPSS 0.7225
EPSS Percentile 98.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Details

CWE
CWE-89
Status published
Products (1)
glpi-project/glpi 10.0.10 - 10.0.15
Published May 07, 2024
Tracked Since Feb 18, 2026