CVE-2026-53629 GLPI - Blind SQL Injection

GLPI before versions 10.0.26 and 11.0.8 contains a blind SQL injection in the history log filter due to improper quoting in SQL criteria, allowing authenticated users with log read rights to inject arbitrary SQL.

CVSS base score n/a
High
CISA KEV
Not listed
Public exploit
Proof of concept available
Authentication
Not required
EPSS
1.02% chance of exploitation in 30 days
View the NVD record ↗

Details

Type
Blind SQL Injection
Impact
Information Disclosure, Denial Of Service
CVSS vector
N/A
Published
25 September 2026
Updated
15 October 2026
Weakness
CWE-89

References

← All CVEs