CVE-2025-24799

Critical

GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory…

GitHub_M·CWE-89·Published 2025-03-18

CVSS

9.8

EPSS

0.86

KEV

Exploits

cve.orgen

180 chars

GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.

NVDen

180 chars

GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.

GLPI es un paquete de software gratuito para la gestión de activos y TI. Un usuario no autenticado puede realizar una inyección SQL a través del endpoint de inventario. Esta vulnerabilidad se corrigió en la versión 10.0.18.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	NVD	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1	Primary	cve.org	7.5	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Primary	cve.org	7.5	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Secondary	NVD	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N