CVE-2025-27147highCWE-22CWE-552CWE-73

CVE-2025-27147: high-severity vulnerability in glpi-project glpi-inventory-plugin

GLPI Inventory plugin has Improper Access Control Vulnerability

Published

Follow this CVE+ Monitor glpi-inventory-plugin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.4%
The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deployment, VMWare ESX host remote inventory, and data collection (files, Windows registry, WMI). Versions prior to 1.5.0 have an improper access control vulnerability. Version 1.5.0 fixes the vulnerability.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L
Affected products
glpi-project · glpi-inventory-plugin
Related CVEs — glpi-project glpi-inventory-plugin

In the same product, most dangerous first.

CVE-2025-32786HIGHGLPI Inventory Plugin is Vulnerable to Unauthenticated SQL InjectionEPSS 7.0%CVE-2022-31062MEDIUMUnauthenticated Local File InclusionEPSS 5.9%CVE-2022-31082MEDIUMSQL Injection via package deployment tasks in glpi-inventory-pluginEPSS 1.0%CVE-2025-26626MEDIUMGLPI Inventory Plugin vulnerable to reflective Cross-site ScriptingEPSS 0.3%CVE-2026-26001HIGHGLPI Inventory Plugin has SQL Injection on dropdown_calendar ReportEPSS 0.2%CVE-2026-25590MEDIUMGLPI Inventory Plugin has Reflected XSS in task jobsEPSS 0.2%