CVE-2024-40638: GLPI-Project GLPI

High severity, CVSS 8.8. EPSS: 38.3% chance of exploitation in the next 30 days.

GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17.

Affected products

• GLPI-Project GLPI: from 0.85, before 10.0.17 (fixed in 10.0.17)

Published 2024-11-15. Last modified 2026-06-17.