GLPI Multiple Vulnerabilities

SQL injection in the logs export feature of GLPI lets an authenticated user with a low-privileged account inject arbitrary SQL through that export component, with assessed impact of high confidentiality and integrity loss (CVSS 8.8). Deployments running GLPI 10.0.0 through before 10.0.24, and the 11.0.0-alpha branch before 11.0.6, are affected; the vendor fixed the flaw in 10.0.24 and 11.0.6. Exploitation is not known to be active (no CISA KEV entry, SSVC exploitation: none) and no public exploit was identified at time of analysis, with EPSS at 0.03% (8th percentile) - realistic risk concentrates on insiders or attackers holding stolen credentials rather than unauthenticated outsiders.

Time-based blind SQL injection in GLPI's Search engine allows remote unauthenticated attackers to extract sensitive database contents and potentially achieve code execution. GLPI versions 11.0.0 through 11.0.5 are vulnerable. The CVSS vector (PR:N) confirms no authentication required, though attack complexity is rated high (AC:H). EPSS data not available, no CISA KEV listing indicates no confirmed active exploitation at time of analysis, but the unauthenticated remote attack surface and SQL injection nature present significant risk for this widely-deployed IT asset management platform.

Stored XSS in GLPI 11.0.0-11.0.5 allows remote attackers to inject malicious scripts via the inventory endpoint without authentication, leading to potential session hijacking and unauthorized actions when victims interact with poisoned inventory data. CVSS 7.5 (High) with Network attack vector and no privileges required (PR:N). No public exploit identified at time of analysis, though the unauthenticated nature and stored XSS persistence elevate practical risk for environments with publicly accessible GLPI installations.

Authenticated GLPI administrators can achieve remote code execution on GLPI 11.0.0 through 11.0.5 by injecting server-side template code, a flaw fixed in 11.0.6. The prerequisite is the highest-trust role in the application (CVSS PR:H, per the advisory the injection is performed 'by an administrator'), so real-world exposure is sharply constrained to already privileged or compromised admin accounts. No public exploit has been identified at time of analysis, EPSS is low at 0.04% (13th percentile), and CISA SSVC records no known exploitation and no automatable path.

Stored cross-site scripting (XSS) in GLPI asset management software allows authenticated technician-level users to inject malicious JavaScript into supplier fields, achieving code execution in victim browsers with high confidentiality, integrity, and availability impact. Affects GLPI versions 0.60 through 10.0.23, patched in version 10.0.24. EPSS data not available; no public exploit identified at time of analysis, and not listed in CISA KEV. The CVSS score of 7.2 reflects network-accessible attack requiring high privileges but no user interaction, making this a medium-priority issue for organizations running vulnerable GLPI instances with multiple technician accounts.