CVE-2025-53105

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 10.0.0 to before 10.0.19, a connected user without administration rights can change the rules execution order. This issue has been patched in version 10.0.19.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Aug 27, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-531068.8Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users CVE-2025-531077.5@cyanheads/git-mcp-server is an MCP server designed to interact with Git repositories. Prior to version 2.1.5, there is a command injection CVE-2025-531085.3HomeBox is a home inventory and organization system. Prior to 0.20.1, HomeBox contains a missing authorization check in the API endpoints re CVE-2025-531097.3Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem pri CVE-2025-531107.3Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem pri CVE-2025-531116.5GLPI is a Free Asset and IT Management Software package. In versions 0.80 through 10.0.18, a lack of permission checks can result in unautho CVE-2025-531124.3GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. CVE-2025-531132.7GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Servi CVE-2025-531147.5CometD is a scalable comet implementation for web messaging. In versions 5.0.0 through 5.0.22, 6.0.0 through 6.0.18, 7.0.0 through 7.0.18, a CVE-2025-531189.8An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to CVE-2025-531197.5An unauthenticated unrestricted file upload vulnerability allows an attacker to upload malicious binaries and scripts to the server.CVE-2025-531209.4A path traversal vulnerability in unauthenticated upload functionality allows a malicious actor to upload binaries and scripts to the server