CVE-2023-29006

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated user that has access to standard interface can craft an URL that can be used to execute a system command. Versions 2.7.7 and 2.10.1 contain a patch for this issue. As a workaround, delete the `ajax/dropdownContact.php` file from the plugin.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Apr 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-290077.8Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40 CVE-2023-290088.8The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing end CVE-2023-290096.1baserCMS is a website development framework with WebAPI that runs on PHP8 and CakePHP4. There is a XSS Vulnerability in Favorites Feature to CVE-2023-29016.5A vulnerability was found in NFine Rapid Development Platform 20230511. It has been declared as problematic. Affected by this vulnerability CVE-2023-290106.5Budibase is a low code platform for creating internal tools, workflows, and admin panels. Versions prior to 2.4.3 (07 March 2023) are vulner CVE-2023-290117.8Git for Windows, the Windows port of Git, ships with an executable called `connect.exe`, which implements a SOCKS5 proxy that can be used to CVE-2023-290127.8Git for Windows is the Windows port of Git. Prior to version 2.40.1, any user of Git CMD who starts the command in an untrusted directory is CVE-2023-290137.5Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go wh CVE-2023-290146.1The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vuln CVE-2023-290156.1The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability CVE-2023-290166.1The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability CVE-2023-290179.8vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handlin