CVE-2025-65035

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. Prior to version 1.1.2, in certain conditions (database write access must first be obtained through another vulnerability or misconfiguration), user-controlled data is stored insecurely in the database via computergroup, and is later unserialized on every page load, allowing arbitrary PHP object instantiation. Version 1.1.2 fixes the issue.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Dec 19, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-650368.3XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro execu CVE-2025-6503710.0Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to execute code over a net CVE-2025-65048.4In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header. Since CVE-2025-650419.8Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.CVE-2025-650463.1Microsoft Edge (Chromium-based) Spoofing Vulnerability CVE-2025-65058.1Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux CVE-2025-65079.8A vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data, potentially leading to arbitrar CVE-2025-650737.5OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Ke CVE-2025-650747.2WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious att CVE-2025-650756.5WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious att CVE-2025-650766.1WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious att CVE-2025-650778.8A relative path traversal vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerabili