CVE-2023-29006

The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated user that has access to standard interface can craft an URL that can be used to execute a system command. Versions 2.7.7 and 2.10.1 contain a patch for this issue. As a workaround, delete the `ajax/dropdownContact.php` file from the plugin.

• CWE-502

• https://github.com/pluginsGLPI/order/commit/c78e64b95e54d5e47d9835984c93049f245b579ePatch
• https://github.com/pluginsGLPI/order/security/advisories/GHSA-xfx2-qx2r-3wwmVendor Advisory
• https://github.com/pluginsGLPI/order/commit/c78e64b95e54d5e47d9835984c93049f245b579ePatch
• https://github.com/pluginsGLPI/order/security/advisories/GHSA-xfx2-qx2r-3wwmVendor Advisory

Published

Apr 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-29000The Nextcloud Desktop Client is a tool to synchronize files …6.5
• CVE-2023-29001Contiki-NG is an open-source, cross-platform operating syste…7.5
• CVE-2023-29002Cilium is a networking, observability, and security solution…6.3
• CVE-2023-29003SvelteKit is a web development framework. The SvelteKit fram…8.8
• CVE-2023-29004hap-wi/roxy-wi is a web interface for managing Haproxy, Ngin…6.5
• CVE-2023-29005Flask-AppBuilder versions before 4.3.0 lack rate limiting wh…7.5
• CVE-2023-29007Git is a revision control system. Prior to versions 2.30.9, …7.8
• CVE-2023-29008The SvelteKit framework offers developers an option to creat…8.8
• CVE-2023-29009baserCMS is a website development framework with WebAPI that…6.1
• CVE-2023-2901A vulnerability was found in NFine Rapid Development Platfor…6.5
• CVE-2023-29010Budibase is a low code platform for creating internal tools,…6.5
• CVE-2023-29011Git for Windows, the Windows port of Git, ships with an exec…7.8