CVE-2026-26263 — GLPI has an Unauthenticated SQL Injection via Search engine
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exists in GLPI's Search engine. This vul…
Published: 2026-04-06 · CVSS: 8.1 · CVSS 3.1
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exists in GLPI's Search engine. This vulnerability is fixed in 11.0.6.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7