CVE-2025-27147: falha de alta gravidade em glpi-project glpi-inventory-plugin
GLPI Inventory plugin has Improper Access Control Vulnerability
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.4%
The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deployment, VMWare ESX host remote inventory, and data collection (files, Windows registry, WMI). Versions prior to 1.5.0 have an improper access control vulnerability. Version 1.5.0 fixes the vulnerability.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L
Produtos afetados
glpi-project · glpi-inventory-pluginCVEs relacionadas — glpi-project glpi-inventory-plugin
No mesmo produto, das mais perigosas para as menos.
CVE-2025-32786HIGHGLPI Inventory Plugin is Vulnerable to Unauthenticated SQL InjectionEPSS 7.0%CVE-2022-31062MEDIUMUnauthenticated Local File InclusionEPSS 5.9%CVE-2022-31082MEDIUMSQL Injection via package deployment tasks in glpi-inventory-pluginEPSS 1.0%CVE-2025-26626MEDIUMGLPI Inventory Plugin vulnerable to reflective Cross-site ScriptingEPSS 0.3%CVE-2026-26001HIGHGLPI Inventory Plugin has SQL Injection on dropdown_calendar ReportEPSS 0.2%CVE-2026-25590MEDIUMGLPI Inventory Plugin has Reflected XSS in task jobsEPSS 0.2%