CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45608 – GLPI has an Authenticated SQL Injection
https://notcve.org/view.php?id=CVE-2024-45608
GLPI is a free asset and IT management software package. An authenticated user can perfom a SQL injection by changing its preferences. Upgrade to 10.0.17. • https://github.com/glpi-project/glpi/security/advisories/GHSA-67p8-v79j-jp86 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43418 – GLPI has multiple reflected XSS
https://notcve.org/view.php?id=CVE-2024-43418
GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17. • https://github.com/glpi-project/glpi/security/advisories/GHSA-x8jv-fcwx-3x6m • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43417 – Reflected XSS in Software form
https://notcve.org/view.php?id=CVE-2024-43417
GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the Software form. Upgrade to 10.0.17. • https://github.com/glpi-project/glpi/security/advisories/GHSA-p633-wfj5-8x44 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-41679 – Authenticated SQL injection in ticket form
https://notcve.org/view.php?id=CVE-2024-41679
GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket form. Upgrade to 10.0.17. • https://github.com/glpi-project/glpi/security/advisories/GHSA-hq9q-jfhp-qqgm • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-41678 – GLPI has multiple reflected XSS
https://notcve.org/view.php?id=CVE-2024-41678
GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17. • https://github.com/glpi-project/glpi/security/advisories/GHSA-xwmx-mmrf-hqf9 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •