UpHeron
All vulnerabilities

Servers and applications

CVE-2019-14666

GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be…

Severity
High 8.8
Published
25 Sept 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
2.2% in the next 30 daysHigher than 82% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
GLPIServers and applications · cpe:a:glpi-project:glpi
  • Every version up to 9.4.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-14666
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-14666