CVE-2022-31062: medium-severity vulnerability in glpi-project glpi-inventory-plugin
Unauthenticated Local File Inclusion
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 5.9%
from disclosure to weapon287 days
Published on NVDJun 20
1st PoC+287d
### Impact A plugin public script can be used to read content of system files. ### Patches Upgrade to version 1.0.2. ### Workarounds `b/deploy/index.php` file can be deleted if deploy feature is not used.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
glpi-project · glpi-inventory-pluginpublic PoCs found — 2
exploitdbwww.exploit-db.com/exploits/51230unverifiedcve_referencepacketstormsecurity.com/files/171654/GLPI-Glpiinventory-1.0.1-Local-File-Inclusion.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — glpi-project glpi-inventory-plugin
In the same product, most dangerous first.
CVE-2025-32786HIGHGLPI Inventory Plugin is Vulnerable to Unauthenticated SQL InjectionEPSS 7.0%CVE-2022-31082MEDIUMSQL Injection via package deployment tasks in glpi-inventory-pluginEPSS 1.0%CVE-2025-27147HIGHGLPI Inventory plugin has Improper Access Control VulnerabilityEPSS 0.4%CVE-2025-26626MEDIUMGLPI Inventory Plugin vulnerable to reflective Cross-site ScriptingEPSS 0.3%CVE-2026-26001HIGHGLPI Inventory Plugin has SQL Injection on dropdown_calendar ReportEPSS 0.2%CVE-2026-25590MEDIUMGLPI Inventory Plugin has Reflected XSS in task jobsEPSS 0.2%