CVE-2025-32786

{
  "id": "CVE-2025-32786",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-04T21:15:36.663",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Versions 1.5.0 and below are vulnerable to SQL Injection. This issue is fixed in version 1.5.1."
    },
    {
      "lang": "es",
      "value": "El plugin GLPI Inventory gestiona el descubrimiento de red, el inventario, el despliegue de software y la recopilación de datos para los agentes GLPI. Las versiones 1.5.0 e inferiores son vulnerables a inyección SQL. Este problema está solucionado en la versión 1.5.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "glpi-project",
          "product": "glpi-inventory-plugin",
          "versions": [
            {
              "version": "< 1.5.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-04T20:42:43.006662Z",
          "id": "CVE-2025-32786",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/glpi-project/glpi-inventory-plugin/blob/1.5.1/CHANGELOG.md",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/glpi-project/glpi-inventory-plugin/releases/tag/1.5.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-w2cp-r675-6xpq",
      "source": "[email protected]"
    }
  ]
}