mreporting affected by a SQLI on date change
Priority LOW 29CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
mreporting is the more reporting GLPI plugin. Prior to 1.9.4, there is a possible SQL injection on date change. This vulnerability is fixed in 1.9.4.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00281 20th percentileScored 2026-11-07
Fix Fixed mreporting (pluginsGLPI): 1.9.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pluginsGLPI | mreporting | before 1.9.4 | 1.9.4 | Patch available | CNA |
- mreporting VendorpluginsGLPI Affected before 1.9.4 Fixed in 1.9.4 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:glpi-project:more_reporting:*:*:*:*:*:glpi:*:* | before 1.9.4 | Vulnerable | glpi-project |
- cpe:2.3:a:glpi-project:more_reporting:*:*:*:*:*:glpi:*:* Versions before 1.9.4 Vulnerable ·glpi-project
Remediation
- Fix · CNA mreporting (pluginsGLPI) Fixed in 1.9.4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-22821
References
More pluginsGLPI vulnerabilities
- TI-2024-36046 The Addressing GLPI plugin allows data enumeration through uncontrolled object instantiation CVSS 3.1HIGH 8.2
- TI-2026-38943 Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering CVSS 4.0HIGH 7.3
- TI-2025-20010 Escalade GLPI Plugin Vulnerable to Improper Access Control CVSS 3.1MEDIUM 6.5
- TI-2026-09772 GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import CVSS 4.0HIGH 7.1
- TI-2024-30621 Fields GLPI plugin has an Authenticated SQL Injection CVSS 3.1HIGH 7.7
- TI-2025-40221 GLPI Database Inventory Plugin Vulnerable to Stored Object Injection CVSS 3.1MEDIUM 6.4
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences