CVE-2024-40638

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Nov 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-40648.8A vulnerability was found in Tenda AC8 16.03.34.09. It has been declared as critical. This vulnerability affects the function R7WebsSecurity CVE-2024-406402.9vodozemac is an open source implementation of Olm and Megolm in pure Rust. Versions before 0.7.0 of vodozemac use a non-constant time base6 CVE-2024-406417.4Nuclei is a fast and customizable vulnerability scanner based on simple YAML based DSL. In affected versions it a way to execute code templ CVE-2024-406428.1The netty incubator codec.bhttp is a java language binary http parser. In affected versions the `BinaryHttpParser` class does not properly v CVE-2024-406439.6Joplin is a free, open source note taking and to-do application. Joplin fails to take into account that "<" followed by a non letter charact CVE-2024-406446.8gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. `gix-path` can be tricked into running another `git.exe` placed in CVE-2024-406458.8FOG is a cloning/imaging/rescue suite/inventory management system. An improperly restricted file upload feature allows authenticated users t CVE-2024-406468.6Vertex is a management tool for PT (Private Tracker) users to manage streaming and watching videos. Versions prior to commit fbde301b97986d5 CVE-2024-406475.3sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK < 2.8.0 allows the environment variables to be passed to s CVE-2024-406485.4matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. The `UserIdentity::is_verified()` method in the matrix-sdk-c CVE-2024-406498.4In TBD of TBD, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege in the CVE-2024-40658.8A vulnerability was found in Tenda AC8 16.03.34.09. It has been rated as critical. This issue affects the function formSetRebootTimer of the