CVE-2025-64520

MediumCVSS 4.3/10Last modified Oct 13, 2026

Description

GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.21, an unauthorized user with an API access can read all knowledge base entries. Users should upgrade to 10.0.21 to receive a patch.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Dec 16, 2025
Last modified
Oct 13, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-645214.8authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secreCVE-2025-645227.6Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are notCVE-2025-645238.8File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2025-645245.5cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other thaCVE-2025-645256.5Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers `x-forwardedCVE-2025-645265.3Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permCVE-2025-645276.5Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authenticatiCVE-2025-645285.3Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a usernameCVE-2025-645296.5SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, CVE-2025-64534.3A vulnerability classified as critical has been found in diyhi bbs 6.8. Affected is the function Add of the file /src/main/java/cms/web/actiCVE-2025-645307.5Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo FederationCVE-2025-645317.8Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution
CVE-2025-64520: Medium severity, CVSS 4.3 | Vulnix