CVE-2023-36808

GLPI vulnerable to SQL injection through Computer Virtual Machine information

8.6 HighPublic exploit

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native inventory.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

47.6%Up 47.5 points since Jul 6, 2023

What each source reports

CVE List Score used 8.6

GLPI vulnerable to SQL injection through Computer Virtual Machine information

Record: CVE-2023-36808
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-89
Updated: 2026-11-02

EUVDEUVD-2023-40744 8.6

Record: EUVD-2023-40744
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-03

NVD 8.6

Record: CVE-2023-36808
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

OSV 8.6

GLPI vulnerable to SQL injection through Computer Virtual Machine information

Record: CVE-2023-36808
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-89
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-36808 8.6

Record: UBUNTU-CVE-2023-36808
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

glpi-project glpi

Affected packages

Affected packages
Package	Affected	Fixed
`glpi` Ubuntu:16.04:LTS	All versions, plus listed versions 0.84.8+dfsg.1-10.84.8+dfsg.1-1ubuntu1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	fransosiche/exploit-cve-2023-36808	2026-06-10

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-36808 is a high vulnerability (CVSS 8.6) in Glpi-project Glpi, published July 5, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 47.6%, the 98th percentile. No source names a fixed version.