CVE-2023-28838

GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 9.5.13 and 10.0.7, a SQL Injection vulnerability allow users with access rights to statistics or reports to extract all data from database and, in some cases, write a webshell on the server. Versions 9.5.13 and 10.0.7 contain a patch for this issue. As a workaround, remove `Assistance > Statistics` and `Tools > Reports` read rights from every user.

• CWE-89

• https://github.com/glpi-project/glpi/releases/tag/10.0.7Patch, Release Notes
• https://github.com/glpi-project/glpi/releases/tag/9.5.13Patch, Release Notes
• https://github.com/glpi-project/glpi/security/advisories/GHSA-2c7r-gf38-358fVendor Advisory
• https://github.com/glpi-project/glpi/releases/tag/10.0.7Patch, Release Notes
• https://github.com/glpi-project/glpi/releases/tag/9.5.13Patch, Release Notes
• https://github.com/glpi-project/glpi/security/advisories/GHSA-2c7r-gf38-358fVendor Advisory

Published

Apr 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28832A vulnerability has been identified in SIMATIC Cloud Connect…7.2
• CVE-2023-28833Nextcloud server is an open source home cloud implementation…8.8
• CVE-2023-28834Nextcloud Server is an open source personal cloud server. Ne…4.3
• CVE-2023-28835Nextcloud server is an open source home cloud implementation…7.5
• CVE-2023-28836Wagtail is an open source content management system built on…5.4
• CVE-2023-28837Wagtail is an open source content management system built on…4.9
• CVE-2023-28839Shoppingfeed PrestaShop is an add-on to the PrestaShop ecomm…9.8
• CVE-2023-2884Use of Cryptographically Weak Pseudo-Random Number Generator…9.8
• CVE-2023-28840Moby is an open source container framework developed by Dock…8.7
• CVE-2023-28841Moby is an open source container framework developed by Dock…6.8
• CVE-2023-28842Moby) is an open source container framework developed by Doc…6.8
• CVE-2023-28843PrestaShop/paypal is an open source module for the PrestaSho…9.8