CVE-2025-24799: GLPI-Project GLPI

Critical severity, CVSS 9.8. EPSS: 86.7% chance of exploitation in the next 30 days.

GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.

Affected products

• GLPI-Project GLPI: from 10.0.0, before 10.0.18 (fixed in 10.0.18)

Published 2025-03-18. Last modified 2026-06-17.