CVE-2020-11032: high-severity vulnerability in glpi-project GLPI
SQL injection on addme_observer and addme_assign in GLPI
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.6epss 1.0%
In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. This is fixed in version 9.4.6.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
Affected products
glpi-project · GLPIRelated CVEs — glpi-project GLPI
In the same product, most dangerous first.
CVE-2020-11060HIGHRemote Code Execution in GLPIEPSS 10.7%CVE-2020-11034MEDIUMbypass of manageRedirect in GLPIEPSS 7.6%CVE-2020-11033MEDIUMAble to read any token through API user endpoint in GLPIEPSS 1.0%CVE-2020-11035HIGHweak CSRF tokens in GLPIEPSS 0.9%CVE-2020-11036HIGHXSS in GLPIEPSS 0.8%CVE-2026-121559HIGHGLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User CloningEPSS 0.5%