CVE-2025-24799

critical

Description

GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.

References

Exploits
More

https://www.bleepingcomputer.com/news/security/one-threat-actor-responsible-for-83-percent-of-recent-ivanti-rce-attacks/

https://thehackernews.com/2026/02/83-of-ivanti-epmm-exploits-linked-to.html

https://www.greynoise.io/blog/active-ivanti-exploitation

https://github.com/galletitaconpate/CVEs

https://github.com/airbus-cert/CVE-2025-24799-scanner

https://github.com/galletitaconpate/CVE-2025-24799

https://github.com/MatheuZSecurity/Exploit-CVE-2025-24799

https://github.com/realcodeb0ss/CVE-2025-24799-PoC

https://github.com/glpi-project/glpi/security/advisories/GHSA-jv89-g7f7-jwfg

Details

Source: Mitre, NVD

Published: 2025-03-18

Updated: 2025-07-31

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H