OCTOBER 9, 2026
Live Feed
Back to database
Case File

CVE-2026-53629

HIGH · CVSS 7.1 EPSS 1.02% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-25 · Last synced 2026-10-09

CyberRota Analysis

AI-Generated

GLPI versions from 9.4.0 to 10.0.26 and 11.0.8 are vulnerable to SQL injection via the history tab, allowing attackers with READ access on logs to manipulate database queries through crafted URLs. The impact of this vulnerability can lead to unauthorized data access or modification. Organizations using affected versions should prioritize upgrading to the patched versions 11.0.8 or 10.0.26 to mitigate potential exploitation risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-53629
Severity
HIGH
CVSS
7.1
EPSS
1.02%

Original NVD Description

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.