CVE-2022-31056: GLPI-Project GLPI

Critical severity, CVSS 9.8. EPSS: 9% chance of exploitation in the next 30 days.

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms (Ticket/Change/Problem) permit sql injection on the actor fields. This issue has been resolved in version 10.0.2 and all affected users are advised to upgrade.

Affected products

• GLPI-Project GLPI: from 10.0.0, before 10.0.2 (fixed in 10.0.2)

Published 2022-06-28. Last modified 2026-06-17.