Read the docs
TI-2012-00951 Aliases CVE-2012-1037GHSA-w885-g67j-xwcg

PHP remote file inclusion vulnerability in front/popup.php in GLPI 0.78 through 0.80.61…

Priority LOW 32CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

PHP remote file inclusion vulnerability in front/popup.php in GLPI 0.78 through 0.80.61 allows remote authenticated users to execute arbitrary PHP code via a URL in the sub_type parameter.

Why it matters now

EPSS 0.01313 70th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:glpi-project:glpi:0.78:*:*:*:*:*:*:*0.78Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.78.1:*:*:*:*:*:*:*0.78.1Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.78.2:*:*:*:*:*:*:*0.78.2Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.78.3:*:*:*:*:*:*:*0.78.3Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.78.4:*:*:*:*:*:*:*0.78.4Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.78.5:*:*:*:*:*:*:*0.78.5Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.80:*:*:*:*:*:*:*0.80Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.80.1:*:*:*:*:*:*:*0.80.1Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.80.2:*:*:*:*:*:*:*0.80.2Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.80.3:*:*:*:*:*:*:*0.80.3Vulnerableglpi-project
  • cpe:2.3:a:glpi-project:glpi:0.78:*:*:*:*:*:*:* Versions 0.78 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.78.1:*:*:*:*:*:*:* Versions 0.78.1 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.78.2:*:*:*:*:*:*:* Versions 0.78.2 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.78.3:*:*:*:*:*:*:* Versions 0.78.3 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.78.4:*:*:*:*:*:*:* Versions 0.78.4 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.78.5:*:*:*:*:*:*:* Versions 0.78.5 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.80:*:*:*:*:*:*:* Versions 0.80 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.80.1:*:*:*:*:*:*:* Versions 0.80.1 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.80.2:*:*:*:*:*:*:* Versions 0.80.2 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.80.3:*:*:*:*:*:*:* Versions 0.80.3 Vulnerable ·glpi-project
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:glpi-project:glpi:0.80.4:*:*:*:*:*:*:*0.80.4Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.80.5:*:*:*:*:*:*:*0.80.5Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.80.6:*:*:*:*:*:*:*0.80.6Vulnerableglpi-project
cpe:2.3:a:glpi-project:glpi:0.80.61:*:*:*:*:*:*:*0.80.61Vulnerableglpi-project
  • cpe:2.3:a:glpi-project:glpi:0.80.4:*:*:*:*:*:*:* Versions 0.80.4 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.80.5:*:*:*:*:*:*:* Versions 0.80.5 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.80.6:*:*:*:*:*:*:* Versions 0.80.6 Vulnerable ·glpi-project
  • cpe:2.3:a:glpi-project:glpi:0.80.61:*:*:*:*:*:*:* Versions 0.80.61 Vulnerable ·glpi-project

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-1037
  2. 2026-10-03 Alias added: GHSA-w885-g67j-xwcg

References

Advisory 1

Other 4

  • TI-2022-16341 /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18516 GLPI allows unauthenticated SQL injection through the inventory endpoint CVSS 3.1CRITICAL 9.8
  • TI-2023-25210 GLPI SQL injection through inventory agent request CVSS 3.1CRITICAL 9.8
  • TI-2023-17986 GLPI vulnerable to SQL injection via inventory agent request CVSS 3.1CRITICAL 9.8
  • TI-2022-13106 SQL injection on login page in GLPI CVSS 3.1CRITICAL 9.8
  • TI-2023-18602 GLPI vulnerable to SQL injection through Computer Virtual Machine information CVSS 3.1CRITICAL 9.8
See all 187 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences