Medium severity · published Dec 19, 2025
CVE-2025-65035
GLPI Database Inventory Plugin Vulnerable to Stored Object Injection
6.4
CVSS
0.3%
EPSS
No
On KEV
Description
pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. Prior to version 1.1.2, in certain conditions (database write access must first be obtained through another vulnerability or misconfiguration), user-controlled data is stored insecurely in the database via computergroup, and is later unserialized on every page load, allowing arbitrary PHP object instantiation. Version 1.1.2 fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
databaseinventory · pluginsGLPI
< 1.1.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-65035
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-65035
github.com
https://github.com/pluginsGLPI/databaseinventory/blob/1.1.2/CHANGELOG.md#112---2025-11-25
github.com
https://github.com/pluginsGLPI/databaseinventory/commit/08c7055d2c5fc744cb092d7d56a608e359c56f1a
github.com
https://github.com/pluginsGLPI/databaseinventory/security/advisories/GHSA-xc3r-32rx-3j4j
More from databaseinventory
4.3
CVE-2025-53360
pluginsGLPI's Database Inventory Plugin allows any authenticated user to send agent requests