CVE-2025-24799
GLPI allows unauthenticated SQL injection through the inventory endpoint
GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
GLPI allows unauthenticated SQL injection through the inventory endpoint
GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.
- Record
CVE-2025-24799- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2025-6704
GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.
- Record
EUVD-2025-6704- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
NVD
GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.
- Record
CVE-2025-24799- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
GLPI allows unauthenticated SQL injection through the inventory endpoint
GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.
- Record
CVE-2025-24799- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-24799
GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.
- Record
UBUNTU-CVE-2025-24799- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
glpiUbuntu:16.04:LTS |
All versions, plus listed versions 0.84.8+dfsg.1-10.84.8+dfsg.1-1ubuntu1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | GLPI Inventory Plugin Unauthenticated Blind Boolean SQLi | 2025-03-12 |
| Nuclei | GLPI < 10.0.17 - Pre-Auth SQL Injection | |
| PoC in GitHub | MatheuZSecurity/Exploit-CVE-2025-24799 | 2025-04-15 |
| PoC in GitHub | MuhammadWaseem29/CVE-2025-24799 | 2025-04-03 |
| PoC in GitHub | airbus-cert/CVE-2025-24799-scanner | 2025-09-16 |
| PoC in GitHub | galisko/CVE-2025-24799 | 2026-09-06 |
| PoC in GitHub | ryhnmhrdka/CVE-2025-24799 | 2025-09-08 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-24799 is a high vulnerability (CVSS 7.5) in Glpi-project Glpi, published March 18, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 86.8%, the 99th percentile. No source names a fixed version.