teclib-edition fields vulnerabilities

Latest teclib-edition fields CVEs

Newest publication first

1. CVE-2026-23489 Fields GLPI plugin vulnerable to RCE in dropdown generation

   Published 2026-03-16

   Critical·CVSS 9.1 EPSS 0.35%

   Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.

2. CVE-2023-28855 Fields GLPI plugin vulnerable to unauthorized write access to additional fields

   Published 2023-04-05

   Medium·CVSS 6.5 EPSS 0.61%

   Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access. Vers...

3. CVE-2019-12723 An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via container_id and old_order parameters to ajax/reorder.php by an unauthenticated user.

   Published 2019-07-10

   Critical·CVSS 9.8 EPSS 2.0%

   An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via container_id and old_order parameters to ajax/reorder.php by an unauthenticated user.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.