CVE-2022-35946

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In affected versions request input is not properly validated in the plugin controller and can be used to access low-level API of Plugin class. An attacker can, for instance, alter database data. Attacker must have "General setup" update rights to be able to perform this attack. Users are advised to upgrade to version 10.0.3. Users unable to upgrade should remove the `front/plugin.form.php` script.

• CWE-89
• CWE-89

• https://github.com/glpi-project/glpi/commit/f542ec8378afbd8038aeca5975b15eca3f0574c8Patch, Third Party Advisory
• https://github.com/glpi-project/glpi/security/advisories/GHSA-92q5-pfr8-r9r2Third Party Advisory
• https://github.com/glpi-project/glpi/commit/f542ec8378afbd8038aeca5975b15eca3f0574c8Patch, Third Party Advisory
• https://github.com/glpi-project/glpi/security/advisories/GHSA-92q5-pfr8-r9r2Third Party Advisory

Published

Sep 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-35940TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-35941TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-35942Improper input validation on the `contains` LoopBack filter …10
• CVE-2022-35943Shield is an authentication and authorization framework for …8.8
• CVE-2022-35944October is a self-hosted Content Management System (CMS) pla…7.2
• CVE-2022-35945GLPI stands for Gestionnaire Libre de Parc Informatique and …6.1
• CVE-2022-35947GLPI stands for Gestionnaire Libre de Parc Informatique and …9.8
• CVE-2022-35948undici is an HTTP/1.1 client, written from scratch for Node.…5.3
• CVE-2022-35949undici is an HTTP/1.1 client, written from scratch for Node.…9.8
• CVE-2022-3595A vulnerability was found in Linux Kernel. It has been rated…5.5
• CVE-2022-35950OroCommerce is an open-source Business to Business Commerce …4.8
• CVE-2022-35951Redis is an in-memory database that persists on disk. Versio…9.8