Medium severity · published Nov 18, 2025
CVE-2025-53360
pluginsGLPI's Database Inventory Plugin allows any authenticated user to send agent requests
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. In versions prior to 1.0.3, any authenticated user could send requests to agents. This issue has been patched in version 1.0.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
databaseinventory · pluginsGLPI
< 1.0.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53360
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53360
github.com
https://github.com/pluginsGLPI/databaseinventory/commit/0a376a0c6f4142e11ea518faefe95c01b176fd87
github.com
https://github.com/pluginsGLPI/databaseinventory/commit/7dcad1efb6ee84e9cffb3b446cdb47dc0be1091e
github.com
https://github.com/pluginsGLPI/databaseinventory/commit/e9d4474acdab4141a6f4798cdd406b0d04480269
github.com
https://github.com/pluginsGLPI/databaseinventory/security/advisories/GHSA-5j5j-xr62-jr58
More from databaseinventory
6.4
CVE-2025-65035
GLPI Database Inventory Plugin Vulnerable to Stored Object Injection