CVE-2021-39211: medium-severity vulnerability in glpi-project glpi
Disclosure of GLPI and server information in telemetry endpoint
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
50Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 5.3epss 4.5%
from disclosure to weapon
Published on NVDSep 15
VulnCheck+789d
GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint discloses GLPI and server information. This issue is fixed in version 9.5.6. As a workaround, remove the file `ajax/telemetry.php`, which is not needed for usual functions of GLPI.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
glpi-project · glpiRelated CVEs — glpi-project glpi
In the same product, most dangerous first.
CVE-2025-24799HIGHGLPI allows unauthenticated SQL injection through the inventory endpointEPSS 86.8%CVE-2020-15175HIGHUnauthenticated File Deletion in GLPIEPSS 69.9%CVE-2023-46727HIGHGLPI SQL injection through inventory agent requestEPSS 67.7%CVE-2024-29889HIGHGLPI contains an SQL injection through the saved searchesEPSS 64.7%CVE-2024-31456HIGHGLPI contains an authenticated SQL injectionEPSS 59.1%CVE-2024-27096HIGHSQL Injection in through the search engineEPSS 58.8%