Login Request a demo
High severity · published Nov 4, 2025
CVE-2025-32786
GLPI Inventory Plugin is Vulnerable to Unauthenticated SQL Injection
7.5
CVSS
7%
EPSS
No
On KEV
Description
The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Versions 1.5.0 and below are vulnerable to SQL Injection. This issue is fixed in version 1.5.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.0% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
glpi-inventory-plugin · glpi-project
< 1.5.1 · source: vendor
Affected product
GL
glpi-inventory-plugin
glpi-project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-32786
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-32786
github.com
https://github.com/glpi-project/glpi-inventory-plugin/blob/1.5.1/CHANGELOG.md
github.com
https://github.com/glpi-project/glpi-inventory-plugin/releases/tag/1.5.1
github.com
https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-w2cp-r675-6xpq
More from glpi-inventory-plugin
8.8
CVE-2026-26001
GLPI Inventory Plugin has SQL Injection on dropdown_calendar Report
8.2
CVE-2025-27147
GLPI Inventory plugin has Improper Access Control Vulnerability
6.5
CVE-2025-26626
GLPI Inventory Plugin vulnerable to reflective Cross-site Scripting
6.1
CVE-2026-25590
GLPI Inventory Plugin has Reflected XSS in task jobs