Read the docs
TI-2025-40221 Aliases CVE-2025-65035

GLPI Database Inventory Plugin Vulnerable to Stored Object Injection

Priority LOW 30CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. Prior to version 1.1.2, in certain conditions (database write access must first be obtained through another vulnerability or misconfiguration), user-controlled data is stored insecurely in the database via computergroup, and is later unserialized on every page load, allowing arbitrary PHP object instantiation. Version 1.1.2 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00324 25th percentileScored 2026-11-07
Fix Fixed databaseinventory (pluginsGLPI): 1.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pluginsGLPIdatabaseinventorybefore 1.1.21.1.2Patch availableCNA
  • databaseinventory VendorpluginsGLPI Affected before 1.1.2 Fixed in 1.1.2 Patch available CNA

Remediation

  • Fix · CNA databaseinventory (pluginsGLPI) Fixed in 1.1.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-65035

References

Other 3

  • TI-2024-36046 The Addressing GLPI plugin allows data enumeration through uncontrolled object instantiation CVSS 3.1HIGH 8.2
  • TI-2026-38943 Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering CVSS 4.0HIGH 7.3
  • TI-2025-20010 Escalade GLPI Plugin Vulnerable to Improper Access Control CVSS 3.1MEDIUM 6.5
  • TI-2026-09772 GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import CVSS 4.0HIGH 7.1
  • TI-2024-30621 Fields GLPI plugin has an Authenticated SQL Injection CVSS 3.1HIGH 7.7
  • TI-2025-33324 pluginsGLPI's Database Inventory Plugin allows any authenticated user to send agent requests CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences