High severity · published Oct 7, 2020
CVE-2020-15176
In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur
8.6
CVSS
1.1%
EPSS
No
On KEV
Description
In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive information like passwords, reset tokens, personal details, and more. The issue is patched in version 9.5.2
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
Glpi · Glpi-project
before 9.5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15176
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15176
Patch
https://github.com/glpi-project/glpi/commit/f021f1f365b4acea5066d3e57c6d22658cf32575
Third Party Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-x93w-64x9-58qw
More from Glpi
9.8
CVE-2022-35914
Teclib GLPI Remote Code Execution Vulnerability
9.8
CVE-2026-26263
GLPI has an Unauthenticated SQL Injection via Search engine
9.8
CVE-2025-66417
GLPI has an unauthenticated SQL injection through the inventory endpoint
9.8
CVE-2025-24799
GLPI is a free asset and IT management software package
9.8
CVE-2025-21619
GLPI is a free asset and IT management software package