CVE-2025-24799

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
glpi-project	glpi	>= 10.0.0, < 10.0.18

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-jv89-g7f7-jwfgVendor Advisory

Timeline

Published: Mar 18, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-24807.8Santesoft Sante DICOM Viewer Pro is vulnerable to an out-of-bounds write, which requires a user to open a malicious DCM file, resulting in e CVE-2025-248009.3Hyperbridge is a hyper-scalable coprocessor for verifiable, cross-chain interoperability. A critical vulnerability was discovered in the ism CVE-2025-248018.8GLPI is a free asset and IT management software package. An authenticated user can upload and force the execution of *.php files located on CVE-2025-248028.6Plonky2 is a SNARK implementation based on techniques from PLONK and FRI. Lookup tables, whose length is not divisible by 26 = floor(num_rou CVE-2025-248035.4Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and sec CVE-2025-248044.3Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and sec CVE-2025-248055.5Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and sec CVE-2025-248062.3Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applicat CVE-2025-248077.1eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to ver CVE-2025-248083.1Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, so CVE-2025-24816.1The MediaView plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id' parameter in all versions up to, and includi CVE-2025-248104.8Cross-site scripting vulnerability exists in Simple Image Sizes 3.2.3 and earlier. If this vulnerability is exploited, an arbitrary script m