UpHeron
All vulnerabilities

Servers and applications

CVE-2020-15176

In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive information like passwords, reset tokens, personal details, and more. The issue is patched in version 9.5.2

Severity
High 8.6
Published
7 Oct 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
9.5.2
Sources
NVD

Affected software

SoftwareAffected versions
GLPIServers and applications · cpe:a:glpi-project:glpi
  • Every version before 9.5.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-15176
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-15176