Skip to content
OpenAdvisories

Product · pluginsGLPI

datainjection

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.4
    CVE-2026-11321

    GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import

    The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with acces…

    pluginsGLPI datainjection