CVE-2013-2226

Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute...

7.5 HighPublic exploit

Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands via the (1) users_id_assign parameter to ajax/ticketassigninformation.php, (2) filename parameter to front/document.form.php, or (3) table parameter to ajax/comments.php.

Exploit likelihood

2.69%Up 1.6 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2013-2226
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-89
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-2226
Updated: 2026-11-02

EUVDEUVD-2013-2179 No score

Record: EUVD-2013-2179
Updated: 2026-11-03

GitHub AdvisoriesGHSA-m4cw-927q-j2jf No score

Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute...

Record: GHSA-m4cw-927q-j2jf
Weakness: CWE-89
Updated: 2026-11-02

OSVMGASA-2013-0288 No score

Updated glpi package fixes security vulnerabilities

Multiple security vulnerabilities due to improper sanitation of user input in GLPI before versions 0.83.9 (CVE-2013-2226), 0.83.91 (CVE-2013-2225), and 0.84.2 (CVE-2013-5696).

This update provides GLPI version 0.83.91, with a patch from GLPI 0.84.2, to fix these issues.

Record: MGASA-2013-0288
Updated: 2026-11-02

OSVUBUNTU-CVE-2013-2226 No score

Record: UBUNTU-CVE-2013-2226
Updated: 2026-11-02

Affected products

glpi-project glpi

Affected packages

Affected packages
Package	Affected	Fixed
`glpi` Mageia:3 From an advisory covering 3 CVEs	before 0.83.91-1.1.mga3	0.83.91-1.1.mga3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	GLPI 0.83.8 - Multiple Vulnerabilities	2013-06-21

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-2226 is a high vulnerability (CVSS 7.5) in Glpi-project Glpi, published September 20, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.69%, the 85th percentile. No source names a fixed version.