CVE-2022-35914

Teclib GLPI Remote Code Execution Vulnerability

9.8 CriticalIn KEVPublic exploit

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

99.9%Up 99.0 points since Sep 20, 2022

What each source reports

NVD Score used 9.8

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

Record: CVE-2022-35914
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-74
Updated: 2026-11-02

CVE List 9.8

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

Record: CVE-2022-35914
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-74
Updated: 2026-11-02

EUVDEUVD-2022-38785 9.8

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

Record: EUVD-2022-38785
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

CISA KEV No score

Teclib GLPI Remote Code Execution Vulnerability

Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed.

Record: CVE-2022-35914
Weakness: CWE-74
Updated: 2026-11-02

OSV 9.8

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

Record: CVE-2022-35914
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	GLPI htmLawed php command injection	2022-01-26
PoC in GitHub	cosad3s/CVE-2022-35914-poc	2022-09-30
PoC in GitHub	Lzer0Kx01/CVE-2022-35914	2022-10-09
PoC in GitHub	6E6L6F/CVE-2022-35914	2022-10-12
PoC in GitHub	0xGabe/CVE-2022-35914	2022-11-06
PoC in GitHub	Johnermac/CVE-2022-35914	2023-03-07
PoC in GitHub	senderend/CVE-2022-35914	2024-04-24
Exploit-DB	htmlLawed 1.2.5 - Remote Code Execution (RCE)	2024-05-19
PoC in GitHub	noxlumens/CVE-2022-35914_poc	2024-08-25
PoC in GitHub	btar1gan/exploit_CVE-2022-35914	2024-09-20
PoC in GitHub	cyb3rk0ala/CVE-2022-35914-RCE	2026-08-11
Nuclei	GLPI <=10.0.2 - Remote Command Execution

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-35914 is a critical vulnerability (CVSS 9.8) in Glpi-project Glpi, published September 19, 2022. CISA lists it as known to be exploited, since March 7, 2023. EUVD reports exploitation since March 7, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.9%, the 99th percentile. No source names a fixed version.

References

Show 4 moreShow less