CVE-2025-65035CWE-502

GLPI Database Inventory Plugin Vulnerable to Stored Object Injection

Medium · published December 19, 2025

CVSS v3.1
6.4
EPSS
0%
Percentile
24.2
In the wild
Unconfirmed
What it is

pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. Prior to version 1.1.2, in certain conditions (database write access must first be obtained through another vulnerability or misconfiguration), user-controlled data is stored insecurely in the database via computergroup, and is later unserialized on every page load, allowing arbitrary PHP object instantiation. Version 1.1.2 fixes the issue.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00324 · 24.2th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2025-12-19T16:35Z
EPSS history
Timeline
  • 19 DEC 16:35Z
    GLPI Database Inventory Plugin Vulnerable to Stored Object Injection
    cvelistv5