CVE-2019-12723: Teclib-Edition Fields

Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days.

An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via container_id and old_order parameters to ajax/reorder.php by an unauthenticated user.

Affected products

• Teclib-Edition Fields: up to and including 1.9.2

Published 2019-07-10. Last modified 2026-06-17.