{"id":"CVE-2022-35914","aliases":["EUVD-2022-38785"],"status":"published","title":"Teclib GLPI Remote Code Execution Vulnerability","description":"/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.99851,"percentile":0.99961,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-74"],"published":"2022-09-19T00:00:00Z","modified":"2026-10-28T02:30:39Z","kev":{"date_added":"2023-03-07","due_date":"2023-03-28","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2023-03-07"},{"source":"kev","since":"2023-03-07"}],"exploits":[{"source":"metasploit","id":"exploit/linux/http/glpi_htmlawed_php_injection","title":"GLPI htmLawed php command injection","type":"exploit","platform":"Linux,Unix","date":"2022-01-26","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/glpi_htmlawed_php_injection"},{"source":"pocgithub","id":"cosad3s/CVE-2022-35914-poc","title":"cosad3s/CVE-2022-35914-poc","date":"2022-09-30","url":"https://github.com/cosad3s/CVE-2022-35914-poc"},{"source":"pocgithub","id":"Lzer0Kx01/CVE-2022-35914","title":"Lzer0Kx01/CVE-2022-35914","date":"2022-10-09","url":"https://github.com/Lzer0Kx01/CVE-2022-35914"},{"source":"pocgithub","id":"6E6L6F/CVE-2022-35914","title":"6E6L6F/CVE-2022-35914","date":"2022-10-12","url":"https://github.com/6E6L6F/CVE-2022-35914"},{"source":"pocgithub","id":"0xGabe/CVE-2022-35914","title":"0xGabe/CVE-2022-35914","date":"2022-11-06","url":"https://github.com/0xGabe/CVE-2022-35914"},{"source":"pocgithub","id":"Johnermac/CVE-2022-35914","title":"Johnermac/CVE-2022-35914","date":"2023-03-07","url":"https://github.com/Johnermac/CVE-2022-35914"},{"source":"pocgithub","id":"senderend/CVE-2022-35914","title":"senderend/CVE-2022-35914","date":"2024-04-24","url":"https://github.com/senderend/CVE-2022-35914"},{"source":"exploitdb","id":"EDB-52023","title":"htmlLawed 1.2.5 - Remote Code Execution (RCE)","type":"webapps","platform":"php","date":"2024-05-19","url":"https://www.exploit-db.com/exploits/52023"},{"source":"pocgithub","id":"noxlumens/CVE-2022-35914_poc","title":"noxlumens/CVE-2022-35914_poc","date":"2024-08-25","url":"https://github.com/noxlumens/CVE-2022-35914_poc"},{"source":"pocgithub","id":"btar1gan/exploit_CVE-2022-35914","title":"btar1gan/exploit_CVE-2022-35914","date":"2024-09-20","url":"https://github.com/btar1gan/exploit_CVE-2022-35914"},{"source":"pocgithub","id":"cyb3rk0ala/CVE-2022-35914-RCE","title":"cyb3rk0ala/CVE-2022-35914-RCE","date":"2026-08-11","url":"https://github.com/cyb3rk0ala/CVE-2022-35914-RCE"},{"source":"nuclei","id":"CVE-2022-35914","title":"GLPI \u003c=10.0.2 - Remote Command Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35914.yaml"}],"products":[{"vendor":"glpi-project","product":"glpi"},{"vendor":"teclib","product":"glpi"}],"references":[{"url":"http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?\u0026Sfs=htmLawedTest.php\u0026Sl=.%2Finternal_utilities%2FhtmLawed","tags":["x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://github.com/glpi-project/glpi/releases","tags":["x_transferred","Release Notes","Third Party Advisory","package"]},{"url":"https://glpi-project.org/fr/glpi-10-0-3-disponible/","tags":["x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","web"]},{"url":"https://github.com/Orange-Cyberdefense/CVE-repository/","tags":["Third Party Advisory","web"]},{"url":"https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.sh","tags":["Exploit","web"]},{"url":"https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914/","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35914","tags":["government-resource","US Government Resource","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35914.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35914","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-35914","description":"/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.","status":"published","published":"2022-09-19T00:00:00Z","modified":"2025-10-21T23:15:35.415Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:34:39.935681Z"}],"euvd":[{"id":"EUVD-2022-38785","description":"/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.","status":"published","published":"2022-09-19T00:00:00Z","modified":"2025-10-21T23:15:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2023-03-07","updated_at":"2026-11-02T20:31:26.48918Z"}],"kev":[{"id":"CVE-2022-35914","title":"Teclib GLPI Remote Code Execution Vulnerability","description":"Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed.","cwes":["CWE-74"],"kev":{"date_added":"2023-03-07","due_date":"2023-03-28","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2022-35914","description":"/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.","status":"published","published":"2022-09-19T16:15:11.253Z","modified":"2026-06-17T04:52:30.6Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:07:28.118799Z"}],"osv":[{"id":"CVE-2022-35914","description":"/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.","status":"published","published":"2022-09-19T00:00:00Z","modified":"2026-10-28T02:30:39.063344362Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:26.195407Z"}]}}