CVE-2023-42802

GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one to upload malicious PHP files to unwanted directories. Depending on web server configuration and available system libraries, malicious PHP files can then be executed through a web server request. Version 10.0.10 fixes this issue. As a workaround, remove write access on `/ajax` and `/front` files to the web server.

• CWE-20
• CWE-434

• https://github.com/glpi-project/glpi/releases/tag/10.0.10Release Notes
• https://github.com/glpi-project/glpi/security/advisories/GHSA-rrh2-x4ch-pq3mVendor Advisory
• https://github.com/glpi-project/glpi/releases/tag/10.0.10Release Notes
• https://github.com/glpi-project/glpi/security/advisories/GHSA-rrh2-x4ch-pq3mVendor Advisory

Published

Nov 2, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42797A vulnerability has been identified in CP-8031 MASTER MODULE…7.2
• CVE-2023-42798AutomataCI is a template git repository equipped with a nati…9.1
• CVE-2023-42799Moonlight-common-c contains the core GameStream client code …8.8
• CVE-2023-4280An unvalidated input in Silicon Labs TrustZone implementatio…9.8
• CVE-2023-42800Moonlight-common-c contains the core GameStream client code …8.8
• CVE-2023-42801Moonlight-common-c contains the core GameStream client code …7.6
• CVE-2023-42803BigBlueButton is an open-source virtual classroom. BigBlueBu…8.8
• CVE-2023-42804BigBlueButton is an open-source virtual classroom. BigBlueBu…5.3
• CVE-2023-42805quinn-proto is a state machine for the QUIC transport protoc…7.5
• CVE-2023-42806Hydra is the layer-two scalability solution for Cardano. Pri…6.5
• CVE-2023-42807Frappe LMS is an open source learning management system. In …9.8
• CVE-2023-42808Common Voice is the web app for Mozilla Common Voice, a plat…6.1