pluginsGLPI datainjection vulnerabilities

Latest pluginsGLPI datainjection CVEs

Newest publication first

1. CVE-2026-11321 GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import

   Published 2026-07-10

   High·CVSS 7.1

   The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injecti...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.