What’s Vulnerable › Vulnerabilities

CVE-2020-15176: SQL injection in GLPI

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-10-07 · updated 2026-06-17
• Weakness: CWE-89

Description

In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive information like passwords, reset tokens, personal details, and more. The issue is patched in version 9.5.2

Affected products

• glpi-project glpi: before 9.5.2 — fixed in 9.5.2

How to fix

Upgrade to a fixed version: glpi-project glpi 9.5.2. Check the vendor advisory for mitigations.

References

• https://github.com/glpi-project/glpi/commit/f021f1f365b4acea5066d3e57c6d22658cf32575
• https://github.com/glpi-project/glpi/security/advisories/GHSA-x93w-64x9-58qw
• https://github.com/glpi-project/glpi/commit/f021f1f365b4acea5066d3e57c6d22658cf32575
• https://github.com/glpi-project/glpi/security/advisories/GHSA-x93w-64x9-58qw

Get alerted when CVE-2020-15176 or the next vulnerability affects your stack