CVE-2026-29047 — SQL Injection in Glpi

CWE-89 — SQL Injection8 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.0%
top 91.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Glpi-project Glpi
Timeline
PublishedApr 6
Latest updateApr 13

Description

GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenticated user can perform a SQL injection via the logs export feature. This vulnerability is fixed in 10.0.24 and 11.0.6.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDglpi-project/glpi10.0.0 — 10.0.24+1
▶CVEListV5glpi-project/glpi>= 10.0.0, 10.0.24, >= 11.0.0-alpha, < 11.0.6+1

🔴Vulnerability Details

2
VulDB
glpi-project glpi up to 10.0.24/11.0.5 Logs Export sql injection (GHSA-3m49-qf92-vccr / Nessus ID 305608)↗2026-04-13
▶
OSV
CVE-2026-29047: GLPI is a free asset and IT management software package↗2026-04-07
▶

🕵️Threat Intelligence

5
Wiz
CVE-2026-29047 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-26263 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-26026 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-25932 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-26027 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶