CVE-2024-40638 — GLPI allows account takeover via SQL Injection in AJAX scripts
GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user …
Published: 2024-11-15 · CVSS: 8.1 · CVSS 3.1
GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7