CVE-2022-31082: falha de média gravidade em glpi-project glpi-inventory-plugin
SQL Injection via package deployment tasks in glpi-inventory-plugin
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.8epss 1.0%
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle inventory management. In affected versions a SQL injection can be made using package deployment tasks. This issue has been resolved in version 1.0.2. Users are advised to upgrade. Users unable to upgrade should delete the `front/deploypackage.public.php` file if they are not using the `deploy tasks` feature.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
glpi-project · glpi-inventory-pluginCVEs relacionadas — glpi-project glpi-inventory-plugin
No mesmo produto, das mais perigosas para as menos.
CVE-2025-32786HIGHGLPI Inventory Plugin is Vulnerable to Unauthenticated SQL InjectionEPSS 7.0%CVE-2022-31062MEDIUMUnauthenticated Local File InclusionEPSS 5.9%CVE-2025-27147HIGHGLPI Inventory plugin has Improper Access Control VulnerabilityEPSS 0.4%CVE-2025-26626MEDIUMGLPI Inventory Plugin vulnerable to reflective Cross-site ScriptingEPSS 0.3%CVE-2026-26001HIGHGLPI Inventory Plugin has SQL Injection on dropdown_calendar ReportEPSS 0.2%CVE-2026-25590MEDIUMGLPI Inventory Plugin has Reflected XSS in task jobsEPSS 0.2%