CVE-2025-53112

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 through 10.0.18, a lack of permission checks can result in unauthorized removal of some specific resources. This is fixed in version 10.0.19.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284 CWE-862

Affected software

Vendor	Product	Versions
glpi-project	glpi	>= 9.1.0, < 10.0.19

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-rp7w-6343-3m2rVendor Advisory

Timeline

Published: Jul 30, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-531132.7GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Servi CVE-2025-531147.5CometD is a scalable comet implementation for web messaging. In versions 5.0.0 through 5.0.22, 6.0.0 through 6.0.18, 7.0.0 through 7.0.18, a CVE-2025-531189.8An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to CVE-2025-531197.5An unauthenticated unrestricted file upload vulnerability allows an attacker to upload malicious binaries and scripts to the server.CVE-2025-531209.4A path traversal vulnerability in unauthenticated upload functionality allows a malicious actor to upload binaries and scripts to the server CVE-2025-531216.9Multiple stored XSS were found on different nodes with unsanitized parameters in OpenMNS Horizon 33.0.8 and versions earlier than 33.1.6 on CVE-2025-531226.9Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenNMS Horizon and Meridian applicati CVE-2025-531318.8Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.CVE-2025-531327.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized at CVE-2025-531337.8Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.CVE-2025-531347.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock CVE-2025-531357.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker