pluginsGLPI fields vulnerabilities

Latest pluginsGLPI fields CVEs

Newest publication first

1. CVE-2026-23489 Fields GLPI plugin vulnerable to RCE in dropdown generation

   Published 2026-03-16

   Critical·CVSS 9.1

   Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.

2. CVE-2024-45600 Fields GLPI plugin has an Authenticated SQL Injection

   Published 2024-12-26

   High·CVSS 7.7

   Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to 1.21.13, an authenticated user can perform a SQL injection when the plugin is active. The vulnerability is fixed in 1.21.13.

3. CVE-2023-28855 Fields GLPI plugin vulnerable to unauthorized write access to additional fields

   Published 2023-04-05

   Medium·CVSS 6.5

   Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access. Vers...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.